Free tools Windows power users keep installed
One-click scans. No signup required.
In May 2014, eBay urged users to change their passwords after attackers used a small number of employee login credentials to access the company network. A database containing encrypted passwords and other non-financial customer information was accessed. eBay said it had no evidence that financial or credit-card information stored separately was accessed. If you still use the same password you used on eBay in 2014, change it anywhere it remains in use and choose a unique password for each account.
What happened in the eBay cyberattack?
eBay said attackers obtained a small number of employee login credentials and used them to enter its corporate network. The company’s forensic investigation placed the attack between late February and early March 2014. eBay said it discovered unauthorized access earlier in May and announced the password-change request on May 21, 2014. eBay’s May 21 announcement and its FAQ described the incident.
The database accessed contained encrypted passwords and other customer data. eBay did not publish a verified count of accounts or records accessed. Its FAQ cited 145 million active buyers in the first quarter of 2014, but that was the size of the active-buyer population—not a count of affected accounts.
What information did eBay say was accessed?
The company listed these customer fields in the database:
#1 Best Overall
- Name
- Encrypted password
- Email address
- Physical address
- Phone number
- Date of birth
eBay said the database did not contain financial information. It also said it had no evidence of unauthorized access to personal financial or credit-card information, which it said was stored separately in encrypted formats. The company’s statement is a report of its contemporaneous findings; it does not prove that payment information could never have been exposed by another route.
eBay UK likewise said on May 23, 2014, that it had no evidence of financial or PayPal compromise. That was the company’s statement at the time, not a guarantee about every account or later event. eBay UK’s notice repeated the password advice.
Rank #2
- Ideal for Gifting
- Ideal for a bookworm
- Compact for travelling
Why did eBay recommend a password change?
Even though the passwords in the accessed database were encrypted, eBay asked users to reset them as a protective measure. On May 21, the company said it would ask users to change their passwords and urged anyone who had reused an eBay password on other sites to change it there too. Password reuse can make a breach at one service a risk to accounts elsewhere, particularly if someone can recover or guess the original password.
On May 28, eBay UK clarified that users who had changed their password on May 21 or later did not need to take additional action at that time. Other users would be prompted at login or before completing a transaction. The follow-up notice described that process. eBay later characterized the incident in its annual report as a Marketplace cyberattack involving user names, encrypted passwords, and other non-financial data that led to a required password reset. eBay’s 2014 annual report records that description.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What should you do if you still use the affected password?
- Change it wherever it is still used. If you still have an eBay account, open eBay through its official website or app and change the password there. Do not rely on a link in an old email.
- Replace reused passwords on other services. eBay specifically advised users who reused their eBay password to change it on those other sites as well. Use a different password for every account.
- Check account activity. Look for transactions, profile changes, or other activity you do not recognize. Contact eBay through its official support channel if you find something suspicious. The 2014 notices do not establish today’s account-recovery steps, so follow the current instructions on eBay’s site.
The notices describe eBay’s response in 2014; they are not current account-recovery guidance. If you cannot access an old account, use the recovery process currently offered by eBay rather than assuming the 2014 reset process still applies.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What the public record does not establish
eBay’s official materials do not identify the attackers, give a confirmed number of accessed accounts, or establish that financial data was exfiltrated. The 145 million figure is an active-buyer count for the first quarter of 2014, not a confirmed breach total. The company’s finding that it had no evidence of payment-data access should be understood as a statement about its investigation at the time.
Quick Recap
Best Value
- It can be a gift option
- Comes with secure packaging
- Helpful in various ways
Rank #4
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
