Ebay vulnerability to hackers?

[izoli]

I'll start with saying that my passwords at least for important sites are different and have a combination of lower/uppercase letters, numbers, and special characters when available. I use Bitdefender Total Security 2017. I'm confident in my ability to browse the Web in a relatively safe manner.

Now with that said, I got an email regarding a purchase I made that I never made. Realized that someone had gained access to my ebay account and used the credit card "on file" to purchase Skype credits and steam store cards.

Not a major issue, I got most of the orders returned before they sent the codes. The Skype credits I won't be charged for from credit company since I'm not liable for fraudulent charges. I changed passwords of course, but I'm wondering if I really picked something up or if ebay itself has vulnerabilities?

 

[ss202sl]

Could be either.

 

[hang-the-9]

I doubt it's because of ebay, my bank had to issue me a new card (the second time it did that), and last week I had someone purchased something on my Amazon account. Which leads me to think that a password list got out in the wild and whoever go it is just trying different websites with the passwords and emails to see what works. I changed all my passwords.

 

[izoli]

I just find it hard to believe they got my password without either a keylogger or from ebay. Bitdefender offers pretty good protection although there's always new shit out there bypassing protections so I won't say it's impossible.

But to just brute force a 16 digits password like ^dX#7gG%09y~{pWe seems pretty much impossible to me.

 

[hang-the-9]

I just find it hard to believe they got my password without either a keylogger or from ebay. Bitdefender offers pretty good protection although there's always new shit out there bypassing protections so I won't say it's impossible.

But to just brute force a 16 digits password like ^dX#7gG%09y~{pWe seems pretty much impossible to me.

Your local anti-virus does not do a thing if a password list from a website was stolen. If your password was really that random, then it would take a bit of doing, but either way something happened that they figured things out. Maybe just did a password reset using your email.