Questions remain about eBay members' info theft

It's still not known who the culprit is nor how and when this person obtained the information.

Questions abound over the posting of confidential information from eBay Inc. members on one of the vendor's discussion forums, a sinister incident that has many of the online marketplace's buyers and sellers worried.

Although eBay has provided some information about the brazen dump of member data that happened Tuesday morning, it's not known who the culprit is nor how and when this person obtained the information.

Even more troubling: What has this "malicious fraudster," as eBay describes the person, already done with the names, addresses, member IDs and possibly credit card numbers of at least 1,200 eBay buyers and sellers?

Moreover, is this person still exploiting whatever hole, trick or vulnerability led him to the data? Does he have data on just the 1,200 members listed or possibly on many more?

"What makes this a big deal isn't just the amount of data compromised, but rather that this involves eBay," said computer security expert Mark Rasch, managing director of technology at FTI Consulting Inc., in Washington, D.C.

As the world's largest online marketplace, eBay stores financial data on millions of users and its platform is used to transact billions of dollars in sales. "Irrespective of the scope [of the data breach], the target makes it significant," Rasch said.

This much is known: On Tuesday morning, someone posted confidential information on about 1,200 eBay members in the company's Trust & Safety discussion forum.

Based on the initial reports of frantic userson this long thread, it appears that the "fraudster" posted data for about one hour until eBay shut the forum down.

Hours later on Tuesday, an eBay spokeswoman confirmed the incident and said the vendor knew for a fact that the information wasn't obtained by breaching eBay's security systems, suggesting instead that the culprit stole the information from others via methods such as phishing.

However, many users have expressed skepticism in the forums over eBay's prompt declaration that its systems weren't hacked into. Rasch shares this skepticism.

"I'd be reluctant to declare six hours after [such an incident] that my systems weren't breached, unless I definitely knew what had happened or had already caught someone," he said.

There can be many ways for someone to obtain this confidential data, including hacking a system and tricking individuals into disclosing the information via phishing, he said. It could also be a case of an inside job perpetrated by a disgruntled or corrupt employee at eBay or elsewhere with access to a database containing this data.