Auction site eBay has urged users to change their passwords after suffering what may have been the biggest-ever cyber-attack when hackers broke into a database holding its 233m customers’ personal data.

EBay said the breach, which was detected two weeks ago, had not given the hackers access to customers’ financial information. But it did affect a database holding encrypted passwords as well as customer names, email addresses, physical addresses, phone numbers and dates of birth which were not encrypted.

The site has 233 million customers worldwide, including more than 14 million active in Britain.

In a statement, the auction site said that a database was compromised between late February and early March. PayPal, the payment arm of eBay, released a statement saying it was not affected and that financial information had not been compromised.

“The scope for damage is absolutely huge and could be the biggest hack of all time, given the number of users eBay has,” said Rik Ferguson, global vice president of security research at security software firm Trend Micro.

While financial information was protected the personal information exposed in the compromise was “neatly packaged information that is worth a lot to cybercriminals and though eBay claims that financial information was not compromised we shouldn’t be reassured by these statements,” said Professor Alan Woodward from the department of computing at the University of Surrey.



“It is inexcusable for a company the size of eBay with the amount of data it holds to not encrypt all personal information held and to not constantly be at the forefront of security technology,” Ferguson agreed. “It should not have taken them three months to notice a break-in like this.”

Exposure of personal information such as postal addresses and dates of birth puts users at risk of identity theft, where the data is used to claim ownership of both online and real world identities. Users are also at risk of phishing attacks from malicious third-parties, which use the private details to trick people into handing over bank account, credit card or other sensitive information.

The break-in was not caused by the “Heartbleed” flaw in internet servers that received publicity this year. Instead, the hackers “compromised a small number of employee log-in credentials, allowing unauthorised access to eBay’s corporate network”, the company said.

The attack is even bigger than that which affected the US retailer Target in December, when around 40m customer credit cards were stolen by hackers, who broke into the company’s systems. The fallout from that security breach led to the resignation of Target’s chief executive in May.

Ebay has been described as the “golden goose” by some security researchers because of its large user base, but other internet companies yet to suffer large hacks of this nature are also considered prime targets.

Amazon, for instance, has around 244m active accounts, each with credit cards attached. Apple’s iTunes – arguably the biggest database of shoppers – has around 800 million users, most of which will have credit cards attached to their accounts.

“Information security and customer data protection are of paramount importance to eBay Inc, and eBay regrets any inconvenience or concern that this password reset may cause our customers,” said an eBay spokesperson.

“We know our customers trust us with their information, and we take seriously our commitment to maintaining a safe, secure and trusted global marketplace.”

Ebay said it is investigating the compromise working with law enforcement and security experts.

“Ebay has been around for a very long time and given people’s passwords habits – keeping the same passwords for years and re-using that password on many different sites – it is more likely to have that common, old password,” said Ferguson.

The company said that there had been “no evidence of the compromise resulting in unauthorised activity for eBay users, and no evidence of any unauthorised access to financial or credit card information”.

Troy Gill, senior security analyst at internet security firm AppRiver said: “This breach is a stark reminder that no organisation is immune to cyberattacks.”

Users will be prompted by email as well as on-site to change their passwords as a precaution, despite the stolen passwords being encrypted and showing no evidence of being compromised.

Shoppers who use the same password on other sites are encouraged to change those passwords too.

“It’s important that people listen to eBay and, when notified by email, change their password, as well as updating any other site which uses the same log-in credentials,” said Chris Boyd, a malware intelligence analyst at security firm Malwarebytes.