After cyberattack, eBay recommends password change

US online giant eBay said Wednesday cyberattackers broke into its database with customer passwords and other personal data in what could be one of the biggest breaches of its kind. The California company said it was notifying its customers, urging them to change passwords to protect their personal and financial information. An eBay statement said the database was compromised between late February and early March and "included eBay customers' name, encrypted password, email address, physical address, phone number and date of birth." But it added that it "did not contain financial information or other confidential personal information." An eBay spokeswoman said the attack did not affect data from PayPal, the finance and payments unit of the company, noting that PayPal data is stored separately. "For the time being, we cannot comment on the specific number of accounts impacted," spokeswoman Kari Ramirez said in an email. "However, we believe there may be a large number of accounts involved and we are asking all eBay users to change their passwords." Potentially affecting eBay's 128 million active users globally, the attack could be one of the largest affecting a retailer, and comes just months after retail giant Target disclosed a breach which could affect more than 100 million. The company said it detected "compromised employee log-in credentials" about two weeks ago and began an investigation. "Cyberattackers compromised a small number of employee log-in credentials, allowing unauthorized access to eBay's corporate network," the company said. The statement added eBay "is aggressively investigating the matter and applying the best forensics tools and practices to protect customers," adding that it was working with law enforcement and security experts. "Information security and customer data protection are of paramount importance to eBay Inc, and eBay regrets any inconvenience or concern that this password reset may cause our customers," the statement said. "We know our customers trust us with their information, and we take seriously our commitment to maintaining a safe, secure and trusted global marketplace." The announcement came amid some confusion about the breach. The company appeared to post a statement, then removed it before issuing a news release, said London-based security consultant Graham Cluley. "eBay's handling of this incident so far been a bit slipshod with its seemingly accidental public leak earlier today," Cluley said in a blog post. "Let's hope the rest of the company's response to this security incident runs a little smoother." Cluley said users should update with a hard-to-crack password following the breach. "Clearly eBay is concerned that the passwords in the compromise database -- albeit encrypted -- could easily be decrypted and fall into the hands of malicious attackers," he said. "Furthermore, although financial information may not have been compromised, it sounds as if other personal identifiable information has been exposed as well." Target has been dealing with the fallout from its massive data breach since news was disclosed in December. Earlier this month, chief executive Gregg Steinhafel announced he was stepping down. In its fourth-quarter report, Target booked a $17 million net charge for the breach, but warned it could not estimate future costs that might stem from claims for customer losses and payments for civil litigation and investigations. A survey released Wednesday by the security firm Trustwave said it identified 691 breaches across 24 countries in 2013, with the number of incidents up 53.6 percent over 2012. "In the majority of cases we investigated, attackers targeted payment card data," the report said. "A global, thriving underground provides for quick monetization of stolen data -- no matter where the victim or attacker resides. As long as criminals can make money by stealing data and selling that sensitive information on the black market, we don't expect data compromises to subside."