BOSTON/SAN FRANCISCO: EBay Inc initially believed that its customers’ data was safe as forensic investigators reviewed a network security breach discovered in early May and made public this week, an executive said.
EBay has come under fire over its handling of the cyberattack, in which hackers accessed personal data of all 145 million users, ranking it among the biggest such attacks launched on a corporation to date.
“For a very long period of time we did not believe that there was any eBay customer data compromised,” global marketplaces chief Devin Wenig said, in the first comments by a top eBay executive since the e-commerce company disclosed the breach on Wednesday.
EBay moved “swiftly to disclose” the breach after it realised customer data was involved, he said. Wenig would not say when the company first realised that the cyberattackers accessed customer data, nor how long it took to prepare Wednesday’s announcement. He said hackers got in using the credentials of three corporate employees, eventually making their way to the user database. Hackers accessed email addresses and encrypted passwords belonging to all eBay users. “Millions” of users have since reset their passwords and the company had begun notifying users, though it would take some time to complete that task, Wenig said. “You would imagine that anyone who has ever touched eBay is a large number,” he said. “So we’re going to send all of them an email, but sending that number all at once is not operationally possible.”
At least three US states are investigating the company’s security practices. Customers have complained on social media about delayed notification emails. And New York’s attorney general called on eBay to provide free credit monitoring services to users. But the Internet retail giant has no plans to compensate customers or offer free credit monitoring for now because it had detected no financial fraud, Wenig said. Wenig declined comment when asked if he thought eBay had good security prior to the breach. He said the company would now bolster its security systems, and has mobilised senior executives in a subsequent investigation of the attack. Reuters
