You’ve probably heard by now that eBay is the latest victim of a massive data breach. The popular site has asked users to reset their passwords as a precautionary measure, but the data that matters most is already compromised, and there is nothing you can do to “reset” it.
Details are still sketchy—sort of standard operating procedure for data breach incidents. What we know is that the breach occurred between February and early March, but was just recently discovered. eBay claims that email addresses, encrypted passwords, names, addresses, telephone numbers, and user’s birth dates were compromised.
Because the passwords were encrypted, there is no immediate risk, but it’s only a matter of time before attackers are able to decrypt them. It definitely makes sense for eBay users to change their passwords. It’s also worth reiterating standard password security practices like making sure you use a strong password, don’t use the same one for multiple sites or services, and change them periodically.
But your eBay password may be the least valuable piece of information from the data that was compromised.
“The fact that user email addresses and physical addresses were taken in the breach is more concerning,” says Dwayne Melancon, CTO of Tripwire. “Criminals could use that information to masquerade as eBay customers on other sites, or perhaps ‘social engineer’ their way to users’ other accounts. Unlike the passwords, the other user-specific information was not encrypted and therefore it can be easily reused by attackers.”
“Many sites can be easily tricked into resetting passwords—requiring a minimum of personal information to do so,” says Paul Lipman, CEO of iSheriff. “The non-encrypted personal data that was stolen from eBay could potentially enable users’ credentials to become compromised on a wide array of other sites through this kind of social engineering technique.”
The attackers can also use information like your phone number, email address, and mailing address for targeted phishing campaigns.
You can’t trust any emails or phone calls you receive. You can’t even trust snail mail. Any communication you receive should be treated with skepticism, and you should contact the company in question yourself to make sure it’s legitimate.
Lipman summed up on a somber note: “Unfortunately, we likely haven’t yet heard the end of this story.”