eBay says that it has been able to narrow down the attack to "a small number of employee login credentials" stolen by cyberattackers. That provided the attackers access to eBay users' names, encrypted passwords, e-mail addresses, physical addresses, phone numbers, and dates of birth.