'Fraudster' posts confidential eBay member info on forum
Data dump leads to shutdown of (ironically) a security-issues discussion list
IDG News Service - Someone used an eBay Inc. discussion forum on Tuesday to post confidential information about eBay users along with what may be their credit card numbers.
The incident, which was first reported by AuctionBytes.com, a technology news site that focuses on e-commerce, led the e-commerce giant to shut down the forum, which ironically is devoted to the discussion of security issues.
Nichola Sharpe, an eBay spokeswoman, confirmed that on Tuesday morning someone the vendor describes as "a malicious fraudster" posted the names and contact information of 1,200 eBay members on the company's Trust & Safety discussion forum.
"This information could have been obtained as part of an account takeover. Since this time, our Trust and Safety team has been proactively addressing this situation," she said via e-mail.
Along with members' information, the "fraudster" also posted what appear to be credit card numbers. However, if that's what they are, they don't match the ones eBay has on file for the members whose contact information was disclosed, Sharpe said.
"We are in the process of proactively contacting members by phone, so that if the information is valid somehow -- regardless how this fraudster acquired the information -- these members can take the steps they need to take to protect themselves," Sharpe said.
The "fraudster" didn't obtain the information by breaching eBay's security systems, so eBay thinks the culprit stole the information via methods such as phishing, she said.
The company has given additional information in an official blog post.
The incident, which eBay continues to monitor, has been broadly reported and commented on by eBay users on this long thread.
In its article, AuctionBytes reported being able to access the forum and view several posts before they were removed.
The posts included fields labeled "Id verified" and "Store" along with a time-date stamp of the user registration, AuctionBytes reported, adding that it hasn't been able to verify the accuracy of the information viewed.
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Defense Throughout the Vulnerability Life Cycle This whitepaper provides insight into how to leverage threat and log management technologies to protect your IT assets throughout their vulnerability life cycle.
- Mobile Policy Checklist Here's what to consider when putting together a mobile policy designed to support a highly productive workforce.
- Securing BYOD Mobile computing is becoming so ubiquitous that people no longer bat an eye seeing someone working two devices simultaneously. Individuals and organizations are...
- Live Webcast On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy...
- Live Webcast Endpoint Backup & Restore: Protect Everyone, Everywhere Arek Sokol from the bleeding-edge IT team at Genentech/Roche explains how he leverages cross-platform enterprise endpoint backup in the public cloud as part...
- Streamline Software Asset Management, Compose a software Management Symphony Keeping track of your organization's software is easy with effective software management solutions from CDW. View the videos in our software solutions channel
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva. All Security White Papers | Webcasts