Loading story…
eBay and three former executives agreed to a nearly $56 million settlement to resolve civil claims brought by journalists Ina and David Steiner over a 2019 harassment and cyberstalking campaign tied to their coverage of the company on EcommerceBytes. The campaign included threatening emails and social media messages, attempted GPS tracking of the couple’s car, and disturbing deliveries such as live cockroaches, a funeral wreath, a bloody pig mask, and a book about surviving the loss of a spouse. The Steiners said the effort was meant to intimidate them and suppress their reporting.
The resolution totals about $55.7 million and includes compensation from eBay and personal payments from former executives, charitable commitments, a public apology, and no confidentiality restrictions. The settlement follows earlier criminal cases in which seven former eBay employees pleaded guilty, with some receiving prison terms, while eBay separately paid a $3 million fine and entered a Deferred Prosecution Agreement with the US Department of Justice. The civil terms also require eBay to publicly condemn the conduct and acknowledge problematic internal communications by senior leaders.
See the reporting duties and controls this puts on the clock.
4 events from the most recent confirmed update back to the earliest known activity.
eBay and three former executives agreed to settle the Steiners' civil case for nearly $56 million, with reporting describing the amount as about $55.7 million. The resolution includes compensation, charitable commitments, personal contributions from former executives, and a requirement for eBay to publicly condemn the conduct and apologize.
Following the harassment campaign, seven former eBay employees pleaded guilty in related criminal proceedings. Ars Technica also notes that former employees received prison terms.
In 2019, eBay personnel carried out a cyberstalking and harassment campaign targeting EcommerceBytes publishers Ina and David Steiner. The conduct included threatening messages, attempted GPS tracking, and disturbing deliveries such as live cockroaches, a funeral wreath, and a bloody pig mask.
As part of the federal criminal resolution, eBay paid a $3 million fine and entered into a Deferred Prosecution Agreement with the U.S. Department of Justice. This was separate from the later civil settlement with the Steiners.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
7 references tracked. Mallory keeps watching after this page renders.
techdirt.com
Open sourcexakep.ru
Open sourcezdnet.fr
Open sourcearstechnica.com
Open sourceteiss.co.uk
Open sourceebayinc.com
Open sourceboingboing.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Comcast agreed to pay **$117.5M** to settle a class action tied to a large-scale breach disclosed in late 2023 that potentially affected **31M+** people. Comcast attributed the intrusion to **CitrixBleed** (Citrix NetScaler ADC/Gateway), a vulnerability that can enable **session hijacking** and credential theft; researchers warned stolen session tokens could remain valid even after patching, extending attacker access. The proposed settlement (preliminarily approved) provides reimbursement for documented losses (up to **$10,000** per person) and compensation for time spent responding, while Comcast denies wrongdoing. Separately, Google agreed to pay **$135M** to settle Android users’ claims that devices transmitted data to Google servers over **cellular networks** in the background without meaningful consent, with individual payouts capped (reported up to **$100**) and additional **injunctive relief** requiring clearer disclosures and express consent during setup. Two dermatology practices also reached settlements over cybersecurity incidents exposing patient data; one New Jersey practice reported unauthorized network access spanning **Dec 2023–Mar 2024** and exposure of **PHI/PII** (including SSNs and treatment/insurance data) affecting **373,630** individuals, offering cash benefits plus credit monitoring/identity protection while denying liability.
Jun 29, 2026
General Motors agreed to pay **$12.75 million** to settle California allegations that it collected, retained, and sold drivers’ geolocation, driving behavior, and other personal data without proper knowledge or consent, in violation of the **California Consumer Privacy Act (CCPA)**. Prosecutors said GM used data gathered through its **OnStar** service and sold it to **LexisNexis Risk Solutions** and **Verisk Analytics**, which sought to use the information in driver-rating products for insurers; California said GM made about **$20 million nationwide** from the sales. Under the proposed settlement, GM must stop selling driving data to consumer reporting agencies for **five years**, delete retained driving data within **180 days** unless consumers provide affirmative express consent for limited internal uses, and ask LexisNexis and Verisk to delete data they previously received. The agreement, which still requires court approval, also requires GM to establish and maintain a privacy program tied to OnStar data collection and provide privacy assessments to California authorities; officials described the penalty as the **largest CCPA fine to date**.
Jun 29, 2026
Yahoo’s massive data breaches triggered consolidated class-action litigation in U.S. federal court after disclosures that attackers had compromised hundreds of millions of accounts and, later, all 3 billion Yahoo accounts. Reporting on the company’s security posture said Yahoo had deprioritized defensive investments and delayed stronger measures such as broader intrusion detection and a mass password reset, while the fallout drew scrutiny from regulators, lawmakers, foreign officials, and users affected in the United States and abroad. The legal fight expanded as a judge ruled that breach victims could pursue claims against Yahoo in the United States, then rejected a proposed settlement covering roughly 200 million people because it did not clearly show how much compensation class members would receive, how large the settlement fund effectively was, or whether attorney fees were reasonable. Yahoo later returned with a revised **$118 million** settlement proposal tied to the broader **3 billion-account** breach, adding commitments to spend more than **$300 million** on information security over four years and maintain a security staff of **200** employees, while ensuring any unawarded legal fees would stay in the fund for victims rather than revert to the company.
Jun 29, 2026