From the Heartbleed website Heartbleed Bug "Bug was introduced to OpenSSL in December 2011 and has been out in the wild since OpenSSL release 1.0.1 on 14th of March 2012. OpenSSL 1.0.1g released on 7th of April 2014 fixes the bug."

I would like to think ebay would have fixed any bugs in the security of their servers well before now, knowing that the heartbleed bug has been out there for more than 2 years. If they knew and did NOTHING to protect all ebay users, then they should at least compensate all users by giving them back the fees charged for the last 2 years as they have left us all vulnerable to data theft and not provided a secure service for which they charge their fees.