eBay's 2014 breach exposed 145M users — and the company waited three months to tell them

In early 2014, hackers used stolen employee credentials to access eBay's corporate network and exfiltrated a database containing approximately 145 million user records — names, addresses, phone numbers, dates of birth and encrypted passwords.

eBay discovered the breach in early May 2014 but did not publicly disclose it until May 21, after the story was reported by tech media. The three-week gap between discovery and disclosure was criticized, and eBay was accused of delaying notification to assess the damage before going public.

eBay urged all users to change their passwords. The case illustrated how employee credentials can be the weakest link in a large organization's security, and how the delay between discovery and disclosure erodes user trust more than the breach itself.