Social EngineeringTechnologyFinancial ServicesInformationPretextingStolen CredentialsCustomer Data InvolvedMulti-Stage ChainPIICredentialsIdentity (basic)LowContained

EBAY INC.

bd_0aa680e1ba0a436a · schema v1 · pii pii-v1

Severity

Low

Discovered

Sep 14, 2023

Filed

Oct 26, 2023

To disclose

6 weeks

Affected · nationwide

201 in this filing

Confidence

66%

Full breach record for EBAY INC. →

eBay notified NH AG of a data incident where a third-party contractor solicited PayPal credentials from 20 customers (1 NH resident) on Aug 12, 2023. eBay detected the issue on Sep 14, 2023, terminated the contractor, and notified PayPal. Notices were sent to affected individuals on Oct 25, 2023.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 33 days

discovery → filing · 6 weeks / 42 days

Aug 12, 2023

Begins

Sep 14, 2023

Discovered

Oct 26, 2023

Filed

vs. sector median

13 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed20 affectedView incident

Name: O'Melveny & Myers LLP
norm: o melveny myers

Name: EBAY INC.
norm: ebay
Industry: TechnologyllmFinancial Servicesllm

Discovered: Sep 14, 2023
Breach occurred: Aug 12, 2023
Undetected for: 33 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 25, 2023
Affected individuals: 20state + nationwide
Data types: PIICredentialsIdentity (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: Partner
Regulator citations: Notified New Hampshire Department of Justice Consumer Protection & Antitrust Bureau
Initial access: trusted_relationship

During the incident: Notified the contractor’s employer
Removed the contractor’s system access at eBay
Notified PayPal through PayPal’s account takeover notification process
Offered free credit monitoring support through Experian IdentityWorks
Changes made: Contractor is no longer employed by eBay’s third-party service provider
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(42 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/ebay-20231026.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 26, 2023
Raw hash: 812c005a7ac363c81074ee1c2be79f428ca5be3bd2e9921a54003f7bbd826378

Reporting entityO'Melveny & Myers LLP

Victim entityEBAY INC.

Incidentdiscovered Sep 14, 2023

Stated responseNotified the contractor’s employer

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov