eBay's breach compromised 145 million accounts through employee phishing, while Spotify's affected just one. Robert Siciliano from McAfee explains why attackers target employees and what eBay sellers and consumers can do to protect themselves.
Chapters
Our top story tonight. First eBay, now Spotify. Hundreds of millions of Americans are seeing their data compromised just this year alone. eBay recently admitting virtually all of its users' sensitive data was compromised months ago. And now today, Spotify announcing a breach as well. Not as big though. The fallout continues tonight and customer backlash mounts. Here with the ramifications to your own personal security is Robert Siciliano, an online security expert for McAfee and Dani Ackerman. She's the founder of the Dani App, and she runs her own business on eBay. Welcome to you both. Great to have you here. Uh, Robert, I'll start with you. So how did these hackers break in using the information of just 3 employees?
So that information, to my knowledge, has not been disclosed. However, what we see in attacks like this is usually via phishing. So employees may receive an email that looks like it's coming from an internal communication disguised with, say, eBay logos in 4 colors and so forth. They open it thinking it's from HR and such, and then next thing you know, they're either providing their credentials to IT, or who they believe is IT, or they're clicking on a link that downloads a virus and compromises their system.
Wow, that is such an easy thing to do when you're at work, thinking you're doing the right thing and getting caught up in something much bigger. Danny, do you— you run a big old business on eBay. You have something like $100,000 in sales a year, been doing it for a number of years. What do you make of this, and what is the reaction on your Facebook page that you put together for eBay businesses like your own?
Yes, of course it gets really concerning because we go to a big company like eBay to run our business, and we think it's safe and secure. So it's a little disconcerting, to say the least. But again, I'm— I don't go into panic mode. It's, it's serious, but If we're proactive and, and we're doing things we're supposed to do, we can protect ourselves.
Robert, to you, don't go into panic mode, obviously, and we'll get to more tips on how to respond in just a second, but it seems to me that consumers generally, maybe not business owners who are so familiar with eBay and its policies, but people who might go on eBay less frequently are a little rattled here. What should they be thinking, and what do you make that 3 US states are investigating this now? We've got some major probes going on. How will that change the course of what happens next?
Yeah, when you have almost, say, half the population of the country's credentials compromised in one single breach, it definitely raises concerns. And you're going to see lawmakers, attorneys general, and others get involved. Sometimes these situations end up in class action lawsuits. However, at this point, I don't see how much damage that has been done would be grounds for any type of a suit. The passwords themselves were encrypted. As far as I know, they have not had any financial losses and no personal data at this point has been compromised. However, when breaches like this do occur, it definitely does raise concern, and consumers obviously need to be on high alert at all times regarding all their accounts.
Well, you couldn't be more right about this. Danny, what are you telling people who have businesses on eBay to keep— what can they do to keep themselves safe?
Something I advise is change your password frequently, especially a site where you run your business from, because ultimately you're in charge of your business and you've got to be proactive and run it like a business.
Robert, you said many Americans, 145 million Americans, were involved in this particular eBay incident. Now we're hearing about Spotify, which is a music streaming service, They only had one person who was compromised. Did they handle this differently? Were they smarter? Did they— were they more proactive than eBay?
So they immediately disclosed the breach, and the fact that one user was compromised is very interesting. I don't think I've ever heard of that before, at least not a national or international announcement being made that one account had been hacked. How that occurred, why, where the breach occurred, and so forth remains to be seen. Whenever these breaches occur, it is always best to disclose as quickly as possible that a breach has occurred, but you wanna maintain secrecy until the breach has been contained. Until they know the extent of it, you shouldn't talk about it, and from what I understand with the Spotify breach, they knew it was only one account, so they immediately disclosed it.
Well, but Robert, that's an excuse to never tell anybody anything. We don't know the extent of the breach yet. We're gonna wait until we, you know, run down every single American all over the world. It seems to me in the past what we've seen with Target and others, that it was such a slow disclosure that in the end we were compromised, the consumers were compromised, because we didn't know right away. What do you say to that criticism?
So there's a reason behind, you know, keeping the breach a secret until you know the full extent of it. If the bad guys know you're on to them, they may switch tactics. And so the corporations that are compromised, they keep it, you know, hush-hush. Law enforcement gets involved, and until they know what needs to be shut down, what portals need to be closed down, what data needs to be secured, they don't say anything because they don't want to give the bad guy the upper hand. It's like, you know, telling the bad guy what your strategy is so he can work around that. That's why they keep it behind closed doors until a certain point.
That's a good point. Dani, to you, should eBay be doing anything for its customers? Some companies have come out and said, you know, we're going to buy you some kind of security filter, we're going to help you check your accounts, we'll help you backstop yourself. We're not hearing that from eBay. Should we?
Well, definitely eBay should be being more proactive, but really I don't understand why it took them months to let their users know. Right. After what you just said, that really puzzles me. But again, We cannot count on eBay to take care of us. We've got to take care of our own businesses.
Well put, Danny. Thank you so much. Robert and Danny, great job, both of you. Thanks so much.
Thank you.
Thank you.
And now we want to know what you think. Here's our question tonight: Are you sticking with eBay? Will you stay on eBay? Will you continue to buy things or sell things on eBay? Log on to JerryWillis.com, vote on the right-hand side of the screen. I'll share the results at the end of tonight's show.
