eBay hack: Users asked to change passwords after cyberattack hits 145 million
Compromised data includes encrypted passwords, home addresses, email addresses, phone numbers and individuals' date of birth
James Vincent is Science and Technology Reporter for The Independent online, and his work appears in print too. In the past he has written freelance for Wired, the New Statesman and the Financial Times.
Wednesday 21 May 2014
If you are a user of online auctioneer eBay it’s time to change your password, after the company admitted it was the victim of what is thought to be the 2nd largest data breach in US history.
Internet security experts said eBay “had questions to answer” last night, as the firm provided few details about how hackers had slipped undetected into its databases.
In an embarrassing disclosure for the firm, which accounted for £126 billion of commerce online last year, it revealed that the breaches involved hackers accessing the details of up to 128 million users as long as three months ago, though the attack was not detected until much more recently.
"Our customers are our highest priority; and to ensure they continue to have a safe, secure and trusted experience on eBay, we will be asking all eBay users to change their passwords," the company told the Telegraph yesterday.
Industry experts have pointed out that the firm is viewed by hackers as the golden goose of targets, with its popularity and massive online reach making it a potential gold mine for cybercriminals.
However the company insisted that it had no evidence of “unauthorised activity” on its members’ accounts and that data on its PayPal money transfer service remained secure.
Despite this reassurance, eBay recommended that its users change their passwords as “best practise” and promised to “enhance security for eBay users”.
Security experts have been quick to point out the breach isn’t restricted to passwords though, with compromised information also including “unprotected” real-world data such as customer names, email addresses, addresses, phone numbers and dates of birth.
Professor Alan Woodward, an internationally respected cybersecurity expert at the University of Surrey, told The Independent: “That this has happed to a big company like eBay results in a collective sigh from everyone involved online security. It just shouldn’t happen.
“I infer from the statement from eBay that what has happened is that a small number of employees with privileged access have fallen prey to something like a phishing attack and inadvertently given away their login credentials.
“However, for something as important as this database, it should take more than just username and password to access it. There should have been two-factor authentication. So, the question is was there and if there was how on earth did the hackers get past it? If not then eBay has some serious questions to answer.”
eBay has not provided any information about the kind of encryption it used to protect passwords, and experts such Prof Woodward have questioned why further personal information on the site was not encrypted at all, leaving the door open for “possible ID fraud” against affected users.
Brendan Rizzo, cyber security expert and the technical director at Voltage Security, a market leader in encryption technology, agrees that the “worrying aspect of this disclosure” was that eBay had left personally identifiable information “completely unprotected”.
He told The Independent: “This information would give the attackers almost all of the information they need to undertake fraudulent activity on a compromised user's behalf. If data is left unprotected, it's not a matter of ‘if’ it will be compromised - it's a matter of ‘when’.”
This won't be the first time this year that Internet users have been asked to reset their passwords, with the Heartbleed bug, discovered in April, triggering widespread cybersecurity worries.
Life & Style blogs
Looking past the search results: Google 2.0 will 'build airports and cities' says report
There is literally not a single woman in this iPhone 6 queue
Anti-depressants can change how the brain works in just hours
iPhone 'Wave': iOS 8 hoax claims you can charge your iPhone in the microwave - you can't
The 'Angelina Jolie effect': Her mastectomy revelation doubled NHS breast cancer testing referrals
Daniele Watts: Django Unchained actress detained by Los Angeles police after being mistaken for a prostitute
Scottish independence referendum: A nation divided against itself
Scottish independence: David Cameron is becoming the 'George Bush of Britain'
Russia freezes Ukraine into submission: Kiev admits country doesn't have enough fuel for winter
Scottish independence: The Queen breaks silence on referendum debate – as think tank warns of £14bn black hole if Scotland votes Yes
Archbishop of Canterbury admits doubts about existence of God
- 1 Mario Balotelli: Staff at arson-hit Manchester Dogs' Home convinced Liverpool striker is behind five-figure donation
- 2 Friends 20th anniversary: Alison Jackson photographs reunited cast
- 3 A bottle of wine a day is not bad for you and abstaining is worse than drinking, scientist claims
- 4 The response to my Pizza Express review has been overwhelming, and taught me a lot about journalism
- 5 Free U2 album: How the most generous giveaway in music history turned into a PR disaster
iJobs Gadgets & Tech
£24000 - £30000 per annum + benefits: Ashdown Group: Graduate BI Consultant (B...
£40000 - £55000 per annum: Ashdown Group: Service Delivery Manager (Product Ma...
£50000 - £70000 per annum: Ashdown Group: Cloud Product and Solutions Marketin...
£18000 per annum: Ashdown Group: An established and growing IT Consultancy fir...