US online giant eBay says cyber attackers cracked its database of passwords and other personal data in what could be one of the biggest breaches of its kind.

The California company said it was its customers, urging them to change passwords to protect their personal and financial information.

An eBay statement said the database was compromised between late February and early March and “included eBay customers’ name, encrypted password, email address, physical address, phone number and date of birth”.

But it added that it “did not contain financial information or other confidential personal information”.

An eBay spokeswoman said the attack did not affect data from PayPal, the finance and payments unit of the company, noting that PayPal data is stored separately.

“For the time being, we cannot comment on the specific number of accounts impacted,” spokeswoman Kari Ramirez said in an email.

“However, we believe there may be a large number of accounts involved and we are asking all eBay users to change their passwords.”

Potentially affecting eBay’s 128 million active users globally, the attack could be one of the largest affecting a retailer, and comes just months after retail giant Target disclosed a breach which could affect more than 100 million of its USA customers.

The company said it detected “compromised employee log-in credentials” about two weeks ago and began an investigation.

“Cyber attackers compromised a small number of employee log-in credentials, allowing unauthorised access to eBay’s corporate network,” the company said.