A Former CEO Paid 3 Million Of His Own Money

Nineteen days in Natick

Between approximately 5 and 23 August 2019, according to the admissions eBay later made to the United States Attorney for the District of Massachusetts, Jim Baugh, the company's former senior director of safety and security, and six other members of eBay's security team targeted a married couple in Natick, Massachusetts. David and Ina Steiner published EcommerceBytes, a newsletter covering issues of interest to eBay sellers. The campaign against them included anonymous deliveries of live insects, a funeral wreath and a bloody pig mask.

The Department of Justice recorded the origin plainly. Senior executives at eBay were frustrated with the newsletter's tone and content, and with the comments posted beneath its articles, and the harassment campaign arose from communications between them. Nineteen days of conduct produced almost seven years of legal consequence.

The criminal case hit its ceiling in 2023

In January 2023 eBay entered a deferred prosecution agreement. It was charged with six felonies: two counts of stalking through interstate travel, two counts of stalking through electronic communications services, one count of witness tampering and one count of obstruction of justice. It agreed to pay 3 million dollars.

That figure was not a negotiation. The Justice Department stated it was the statutory maximum fine for those six offences. Whatever a prosecutor thought the conduct was worth, three million was the most the criminal code could reach. eBay also agreed to retain an independent corporate compliance monitor for three years and to make extensive enhancements to its compliance programme.

An owner reading that resolution in 2023 would reasonably have filed it as closed, priced, and survivable. The number was public, the monitor was appointed, and the company continued trading. The exposure that mattered had not started yet.

The admission outlived the case that produced it

To obtain the deferred prosecution agreement, eBay admitted to a detailed recitation of all the relevant facts about its conduct. That is the standard price of such an agreement, and it is usually treated as the cost of closing the matter quickly.

The Steiners had filed a civil suit in Boston federal court in 2021, alleging a conspiracy to intimidate, threaten to kill, torture, terrorise, stalk and silence them in order to stifle their reporting on eBay. Their case ran on, alongside a public record in which the defendant company had already conceded the facts in detail.

On 27 July 2026 their law firm, Scalli Murphy Law, announced a settlement and filed notice in the same court dismissing the claims. The criminal matter had taken about three and a half years to resolve. The civil one took another three and a half years after that.

Who actually wrote the cheques

The settlement totals 55.7 million dollars. The Steiners receive 48.7 million in compensation: 46.15 million from eBay, 2 million from former chief executive Devin Wenig, 500,000 dollars from Wendy Jones, formerly senior vice president of operations, and 50,000 dollars from Steve Wymer, formerly chief communications officer. A further 7 million goes to charitable commitments, 6 million from eBay and 1 million from Wenig to an organisation protecting First Amendment rights, in Ina Steiner's name.

Two proportions are worth writing down. The company paid 52.15 million, or 93.6 per cent. The three named individuals paid 3.55 million between them, 6.4 per cent, from their own funds. And the total is 18.6 times the maximum penalty the criminal code allowed three years earlier. None of the three was criminally charged, and a civil settlement is not a finding of liability against them.

The non-financial terms are the ones a board should study. There is no confidentiality provision, so the Steiners may discuss the case publicly for as long as they wish. eBay further committed to issue a strongly worded public statement about the conduct of Wenig, Wymer and Jones and about the company culture of that period. The money is finite. That statement is not.

Europe now has the same channel

European owners tend to model regulatory exposure and stop there. Under the GDPR the headline is a percentage of global turnover, under NIS2 and DORA it is a supervisory penalty, and each of those has a ceiling that a finance director can put in a spreadsheet.

Article 82 of the GDPR does not have that shape. It gives any person who has suffered material or non-material damage from an infringement a right to compensation, and the Court of Justice has declined to impose a minimum threshold of harm before such a claim can be brought. Since 25 June 2023, the representative actions regime under Directive 2020/1828 has additionally allowed qualified entities to bring collective redress actions across member states, and data protection sits within its scope.

The instruction is narrow and worth acting on this quarter. When your counsel proposes settling with a regulator by conceding a factual narrative, ask who else will be able to read that narrative, and for how long, and price the private claim that follows it rather than the fine that closes it. Then ask your insurer, in writing, what an individual officer's uninsured position looks like the day after the company has admitted the facts.

The eBay case is extreme in its conduct and ordinary in its structure. A capped public penalty arrived first and looked like the end of it. The uncapped private claim arrived second, cost eighteen times more, reached into three people's own accounts, and bought no silence at all.

Read next: Blocking the Crawler Is What Published Your Chats  |  Health Records Change Law the Moment They Move