eBay Executives Mailed a Blogger Live Cockroaches and a Pig Fetus. A Jury Just Put the Price at $41.5 Million

A fetal pig. Live cockroaches. A funeral wreath. That is a partial shipping manifest of what executives at a company then worth tens of billions of dollars sent to a husband-and-wife blogging team in 2019. Six years later, a Massachusetts jury has ordered the individual defendants to pay $41.5 million in damages. Read the headline and it sounds like a plot rejected for being too on-the-nose. Read the case file and it’s something more useful: a documented record of what happens when a platform decides a critic is a problem to be solved.

It started with a newsletter

Ina and David Steiner ran EcommerceBytes, a trade publication for people who sell things on marketplaces — eBay, Amazon, Etsy. Think of it as a local paper for a town of tens of thousands of small merchants. Fee changes, policy updates, seller account suspensions, all covered from the seller’s side of the counter.

That framing was the problem. eBay’s leadership read the coverage as hostile, and in April 2019 then-CEO Devin Wenig texted an executive about a Steiner article with three words that later surfaced in court: Take her down.

Prosecutors pointed to that message as the origin point for everything that followed. Wenig was never criminally charged and has maintained he meant nothing literal by it. Whether he did or not, the more revealing question is how the sentence was received inside the organization — and the answer to that is the rest of this story.

The shipping list

The people who acted on it worked in eBay’s Global Security & Resiliency team. A department built to protect the company was redirected at someone writing about it.

What arrived at the Steiners’ home in Natick, Massachusetts: live cockroaches, fly larvae, a fetal pig, a funeral wreath, a bloody pig mask, and pornographic material addressed to David but sent to neighbors. Anonymous Twitter accounts sent threatening messages. Employees drafted plans to post flyers around the neighborhood advertising sexual services at the Steiners’ address.

Then it escalated from mail to surveillance. Employees drove from eBay’s Boston-area offices to Natick to watch the house in person. They attempted to attach a GPS tracker to the couple’s car. And the endgame was the part that reads worst in hindsight: another eBay employee was to approach the Steiners offering to help them deal with the harassment the company had manufactured — build rapport, become the trusted contact, and use that relationship to soften the coverage.

Two tracks: criminal and civil

The scheme collapsed by accident. Natick police, a suburban department of modest size, investigated the harassment complaints, traced IP addresses, and followed the trail to eBay’s corporate network. Local cops with a subpoena took down a security operation run by a Fortune 500 company.

Seven people pleaded guilty. Jim Baugh, eBay’s former senior director of safety and security, got 57 months in federal prison. David Harville, former director of global resiliency, got 24 months. eBay itself paid a $3 million criminal penalty — which the Justice Department noted at the time was the statutory maximum available. That detail did more to fuel the discussion than the fine itself: for a company with revenue in the billions, the legal ceiling for organized cyberstalking was $3 million.

Which is why the real reckoning happened in civil court. The Steiners sued eBay and the individuals involved; eBay settled with the couple separately in 2025 for an undisclosed sum. The case against the remaining individual defendants went to trial, and the jury returned $41.5 million, including punitive damages. Punitive awards are the jury’s way of saying this wasn’t a few people going rogue on their own time.

Why it’s worth revisiting now

Here’s an honest observation: search the last month of Hacker News, Reddit, and X for fresh debate about this case and you find almost nothing. The verdict landed, and the conversation didn’t. That absence is part of the story. When the scheme broke in 2020, it sat at the top of HN and r/technology for days. Six years of litigation later, the outrage has fully dissipated. For a corporate defendant, the calendar is the cheapest defense counsel available.

The case keeps getting cited anyway, because it sits on top of three structural problems that haven’t gone anywhere.

Corporate security teams have real capability and thin oversight. Enterprise security organizations hold data access, threat intelligence tooling, OSINT platforms, and in some cases physical surveillance resources. All of it is built and justified as defensive. Nothing in the tooling distinguishes between tracking a fraud ring and tracking a journalist. The instruction does that, and the instruction came from the top.

Trade press that covers a platform depends on that platform. EcommerceBytes wrote about eBay for an audience of eBay sellers. Its subject controlled its readers’ livelihoods. Publications in that position are already vulnerable to ordinary pressure — pulled advertising, revoked press access, a quiet word to sources. This went orders of magnitude past ordinary, but the underlying dependency is the normal condition for most vertical trade media, from ad tech to app-store coverage.

Nobody in the chain said no. A three-word text traveled through multiple departments and seniority levels and turned into a stakeout, and not one person in that chain stopped it. Individual bad actors don’t explain that. Culture does.

What’s left over

eBay says it terminated everyone involved and overhauled its policies. Wenig stepped down as CEO in September 2019. The company said his departure was unrelated to the investigation. The timing invited its own conclusions.

$41.5 million is a serious number, and it doesn’t buy back what the Steiners went through — they described being afraid in their own house, and testimony at trial covered lasting psychological harm. But the most uncomfortable detail isn’t the money. It’s the reason any of this became public: the perpetrators were sloppy. They shipped physical packages with tracking numbers. They created Twitter accounts from IP addresses that resolved to their employer. A slightly more careful team leaves no parcels and no logs, and the Steiners spend the rest of their lives not knowing why the cockroaches showed up.

So the next time your favorite trade newsletter or independent tech blog takes a real swing at a company with a security budget, it’s worth asking what the writer is exposing themselves to. A verdict makes the harm expensive. It doesn’t make it unlikely.