Connect with us

Hi, what are you looking for?


Incident Response

eBay, Security Experts Say Database Dump is Fake

Security experts and eBay have confirmed that a recent user database being advertised on Pastebin was not obtained as a result of the data breach suffered by the online marketplace earlier this year.

Security experts and eBay have confirmed that a recent user database being advertised on Pastebin was not obtained as a result of the data breach suffered by the online marketplace earlier this year.

On May 21, eBay admitted that its corporate network had been breached sometime between late February and early March 2014. The attackers compromised the login credentials of a small number of employees and used the data to gain access to the details of eBay’s 145 million customers. The breach was discovered only in early May.

While there’s no evidence that financial information has been compromised, or that PayPal customers are impacted, the cybercriminals have managed to gain access to names, email addresses, physical addresses, phone numbers, dates of birth and encrypted passwords.

It’s uncertain who is behind the attack, but other cybercriminals and scammers are already trying to profit from the incident. Experts have reported seeing a higher number of PayPal and eBay phishing attacks, and, a post on Pastebin was found offering to sell 145,312,663 eBay customer records for 1.453 Bitcoin (around $750).

The seller has published a sample of 12,663 names, password hashes, email addresses, physical addresses, phone numbers and dates of birth allegedly belonging to eBay customers in the Asia-Pacific region.

Both security experts and eBay have analyzed the sample and determined that the data is fake. eBay representatives say none of the credentials appear to belong to customers.

Security expert Kenn White has also analyzed the data and found that it appears to originate from older leaks.

Security blogger Brian Krebs also believes that the data is fake. Allison Nixon, a threat researcher with Deloitte & Touche LLP, has told Krebs that the scammers are most likely hoping that security companies will purchase the data for research purposes.

Advertisement. Scroll to continue reading.

In its official data breach announcement, eBay failed to disclose how it encrypts customer passwords, but  company representatives have told Reuters that a “sophisticated, proprietary hashing and salting technology” is used to protect them. On Twitter, eBay noted that passwords are hashed and salted, and there is no evidence that the encryption has been broken.

However, users are advised to change their passwords as a precaution. While some have criticized the company for not forcing password resets, as Australian security expert Troy Hunt highlights, that might not be such a good idea.

First of all, if the passwords are stored cryptographically and the company is confident that the information can’t be cracked easily, forcing a reset may be “overkill.” Furthermore, as Hunt explains, resetting the passwords of 145 million people at the same time and asking them to visit the site to set new ones might be too much for eBay’s servers, and it could be like launching a DDOS attack against themselves.

Another important aspect emphasized by Hunt and other security experts is the fact that it took eBay such a long time to detect the breach.

“What I find very distressful is the fact that the breach occurred 2 months ago and they found out just two weeks ago,” IT security expert Sorin Mustaca told SecurityWeek.

As far as disclosing information about the incident, Mustaca noted, “eBay is very careful in what they disclose because they are afraid of being sued. And indeed, I’ve seen in the media that there are already some attempts to sue them over their practices in what the security of the network is concerned.”

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join us as we delve into the transformative potential of AI, predictive ChatGPT-like tools and automation to detect and defend against cyberattacks.


As cybersecurity breaches and incidents escalate, the cyber insurance ecosystem is undergoing rapid and transformational change.


Expert Insights

Related Content


A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...

Data Breaches

LastPass DevOp engineer's home computer hacked and implanted with keylogging malware as part of a sustained cyberattack that exfiltrated corporate data from the cloud...

Incident Response

Microsoft has rolled out a preview version of Security Copilot, a ChatGPT-powered tool to help organizations automate cybersecurity tasks.

Data Breaches

GoTo said an unidentified threat actor stole encrypted backups and an encryption key for a portion of that data during a 2022 breach.

Application Security

GitHub this week announced the revocation of three certificates used for the GitHub Desktop and Atom applications.

Incident Response

Meta has developed a ten-phase cyber kill chain model that it believes will be more inclusive and more effective than the existing range of...

Artificial Intelligence

Two new surveys stress the need for automation and AI – but one survey raises the additional specter of the growing use of bring...