Social media is abuzz today about eBay’s massive account breach. From news reports and press releases, this breach potentially affects 145 million of its customers which means many of you reading this blog post are most likely affected. From what SecureState has gathered, eBay employee credentials were compromised back in late February/early March and were used to access a database containing the following customer information:
- Names
- Addresses
- Birthdates
- Encrypted Passwords
- Physical Addresses
- Phone Numbers
Fortunately, there is no indication that credit card data or other financial information was compromised. What’s alarming is the mention of “encrypted passwords”. We hope that this doesn’t equate to “poorly stored” passwords. Right now there is no indication that randomized salts or other password storage protections were in place.
Immediate Action to Take
As with any password breach, change your eBay account password immediately. While there is no indication that eBay’s sister company PayPal was affected, we advise that you change any PayPal account passwords for safe measure. If you unfortunately use this same password on other critical sites, you should change those passwords as well. Hopefully you’re using unique passwords for every site or service you use, right? If not you should start using a password manager like KeePass or LastPass, so when the next password breach happens, you’ve got a lot less to worry about!
Beware of eBay Phishing Emails
Lastly, be on the lookout for phishing emails related to this password breach in the next day or so. This is a social engineering attack we commonly see after a large breach like this. We recommend that you manually type “ebay.com” into your web browser and change your password that way. Be suspicious of any email that asks you to click a link to change your password via email. This applies to all your accounts, not just eBay.
Tom Eston is the manager of SecureState’s Attack & Defense Team. You can follow Tom on Twitter @agent0x0. Be sure to follow @SecureState to keep up to date on the latest information security news.