eBay's 2014 breach exposed 145M users — and the company waited three months to tell them

In early 2014, hackers used stolen employee credentials to access eBay's corporate network and exfiltrated a database containing approximately 145 million user records — names, addresses, phone numbers, dates of birth and encrypted passwords.

eBay discovered the breach in early May 2014 but did not publicly disclose it until May 21, after the story was reported by tech media. The three-week gap between discovery and disclosure was criticized, and eBay was accused of delaying notification to assess the damage before going public.

eBay urged all users to change their passwords. The case illustrated how employee credentials can be the weakest link in a large organization's security, and how the delay between discovery and disclosure erodes user trust more than the breach itself.

eBay discovered the breach in early May but waited three weeks to disclose, and the delay eroded trust more than the breach itself.

Hackers used stolen employee credentials to access eBay's network.

145M user records were stolen.

eBay discovered the breach in early May but did not disclose until May 21.

The three-week delay between discovery and disclosure was criticized.

Employee credentials are the weakest link. eBay's breach started with a stolen login, not a sophisticated exploit. The three-week delay eroded trust more than the breach itself.

eBay reset passwords and strengthened its authentication systems. The case contributed to the broader adoption of multi-factor authentication in enterprise environments.