)
eBay Inc, operator of the online-auction site, asked users to change their passwords after a cyber-attack exposed a database with login information and data such as birthdays and phone numbers.
There's no evidence of unauthorised activity resulting from the breach, eBay said on Thursday in a statement. While credit-card numbers are stored separately and encrypted, it's still best to change passwords, the company said.
eBay's revelations come on the heels of a web-security bug known as Heartbleed, made public on April 7, and follows high-profile consumer-data breaches at Target Corp and Neiman Marcus Group Ltd In this case, hackers reached eBay's corporate network by getting access to a small number of employee passwords, prompting the company to disclose the attack.
"Cybersecurity and cyber-attacks have really become as much a part of day-to-day life as folks using the internet and mobile offerings," said Scott Kessler, an analyst at S&P Capital IQ in New York. "This seems like mostly a precaution but a precaution that companies find themselves increasingly looking to communicate about."
eBay, based in San Jose, California, is asking users to change their passwords on its own service and on any other site where that password is used. Activity on eBay's website has been normal since the breach was revealed on Thursday, showing no impact from the announcement, according to a person with knowledge of the matter. Kari Ramirez, a spokeswoman for eBay, declined to comment.
eBay's disclosure stands in contrast to the actions of three US public companies that were recently identified as Chinese hacking victims.
The companies, including Alcoa Inc and Allegheny Technologies Inc, didn't report the theft of trade secrets and other data to investors, according to a Justice Department indictment unsealed on May 19.
Still, the breach at EBay prompted concerns among some authorities. Dustin McDaniel, attorney general for the state of Arkansas, said it shows the need for retailers to strengthen their security efforts.
"My office has been actively investigating the Target breach," McDaniel said in a statement. "We are already talking to representatives of EBay to find out how this breach occurred and whether there is any long-term impact on Arkansas consumers."
Not PayPal
EBay said it's working with police and security experts to investigate the breach, which occurred between late February and early March. The database that was compromised contained encrypted passwords and personal information on EBay users, though not financial data, nor any personal or financial information about customers of its PayPal payment unit, the company said.
"PayPal data is stored separately on a secure network, and all PayPal financial information is encrypted," EBay said.
The breach was first detected about two weeks ago, the company said. "Extensive forensics" identified the compromised database, resulting in the announcement today. EBay's Marketplaces business had about 145 million active buyers at the end of the first quarter.
The stock fell less than 1 percent to $51.88 at the close in New York. The shares have dropped 5.4 percent this year.
The Heartbleed bug, unrelated to the EBay attack, was spotted by a cybersecurity firm that was looking for gaps in communications software called OpenSSL. The OpenSSL Project announced the bug and the availability of a fix for it last month, sending Web companies scrambling to apply a patch.
After last year's security breaches at Target and Neiman Marcus, data-security professionals urged U.S. retailers to upgrade their credit- and debit-card technology to reduce fraud.
