Questions remain about eBay members' info theft

"EBay has to thoroughly and comprehensively investigate this and keep people advised of what it finds and take corrective actions," Rasch said.

This doesn't mean that eBay must provide hourly updates on the progress of its investigation, he said. However, eBay must at some point publicly close the loop on the incident and explain the scope of the damage and the causes.

It's unclear if eBay intends to reveal more details about the breach. Beyond the spokeswoman's comments on Tuesday, the only other eBay statement on the matter is anofficial blog postmade a few hours after the incident.

By press time, eBay hadn't responded to several requests for comment on Wednesday.

Jonathan Garriss, executive director of the Professional eBay Sellers Alliance, agrees that eBay must inform users about the issue.

"EBay really needs to address this publicly at some point and say where the leak came from," said Garriss, also CEO of Gotham City Online, anapparel store on eBaythat also hasits own site. That way, buyers and sellers will feel that the issue was addressed and remedied.

It's clear that the data thief, in addition to profiting from the compromised information, also wanted very much to embarrass eBay by using the vendor's discussion forum for security issues as the vehicle for the data disclosure. "It was very brazen and very public," Rasch said.

On Tuesday, the eBay spokeswoman said that the credit card numbers disclosed didn't match with the ones eBay has on file for the affected members.

This brings up another question: Even if the numbers don't match the members, does eBay know if those numbers are nonetheless valid? Once data is posted on a public Web site, it must be assumed that others with malicious intentions copied it.

"The bottom line is that this data is in the hands of people who shouldn't have it," Rasch said.