eBay data breach (2014): what happened and what to do
2 min read · Updated November 8, 2026
In May 2014 eBay announced that attackers had accessed a database containing about 145 million users’ names, email addresses, physical addresses, phone numbers, dates of birth and encrypted passwords. Financial data was held separately and not reported affected. Change reused passwords and enable two-factor authentication.
What happened
eBay said the attackers used the login details of a small number of employees to reach the corporate network between February and March 2014. The company discovered the compromise in early May and asked all users to change their passwords.
The disclosure came about two weeks after the problem was found, and the long gap between the intrusion and the announcement drew criticism.
What was exposed
- ✓Names, email addresses and postal addresses.
- ✓Phone numbers and dates of birth.
- ✓Encrypted passwords. Payment data was stored separately and was not reported as affected.
Were you caught up in a major breach?
Old breaches keep circulating for years. Scan your email against known breach records for a one-time $1.99.
Why it still matters
Personal profile data is useful to criminals even without passwords. A name, address and birth date together help with impersonation and with convincing phishing aimed at marketplace users.
If you used the same password on eBay and elsewhere, attackers could try it against other accounts, which is why a password change mattered beyond eBay itself.
What to do
- ✓Check your email address to see whether it appears in known breach records.
- ✓Change any password you used on the affected service, and anywhere you reused it.
- ✓Turn on two-factor authentication, starting with email and financial accounts.
- ✓Be careful with unexpected messages that mention the service.
Frequently asked questions
Were credit card numbers taken?+
eBay said financial and payment information was stored on a separate system and there was no evidence it was accessed.
Is my old eBay account still at risk?+
If you reused its password elsewhere, yes. Change those passwords and turn on two-factor authentication for accounts that matter.
How can I tell a fake eBay email?+
Do not click links in the message. Open the site or app directly and check your account messages there.
Stop guessing. Check your email in seconds.
The Leakill scan looks for your email address in known breach records and delivers a detailed report: the incidents, dates, sources, the kinds of data involved and practical next steps. It is a one-time $1.99 payment, not a subscription.
A breach match is a warning signal, not proof that someone has access to your account today. No public database covers every breach, so a clean result lowers risk without guaranteeing safety.