eBay said Friday, in a filing with the U.S. Securities and Exchange Commission, that about 141,000 users have now joined lawsuits against IAC, 2,000 more than the auction giant listed in its prior quarterly filing. IAC previously had notified most of its roughly 20 million users that cybercrooks had stolen names, addresses, transaction and refund data.

A Koean consumer agency recommended that IAC pay about $35 to $70 to each user who complained, eBay said in the filing, though users have been paid about $200 each in “consolation money” in some prior cases “without a specific finding of harm.” Under the consumer agency’s guidelines, eBay could face payments of as much as $9.9 million to those who filed lawsuits. If, however, the complaints burgeoned to even one-tenth of the unit’s 20 million users, those payments could swell to $140 million.

There was no immediate response from eBay to a request for comment. Shares of eBay fell $0.48, or 3.9 percent, to $11.71 in Monday afternoon trading as the technology-heavy Nasdaq and other major U.S. indexes encountered strong headwinds.

The latest annual 10K filing was the first to mention the consumer agency recommendation. A quarterly filing in July 2008 noted the data breach and users then totaling about 135,000 who had sued IAC.

eBay acquired a majority interest in IAC, then known as Internet Auction Company, in 2001 and three years later it snapped up the remaining publicly held shares.

It was not immediately clear when the IAC data breaches occurred. eBay said the cyber-theft did not involve credit card or “real-time banking information.”

eBay, best known as the leading online auction site, also owns ticket auctioneer StubHub and Internet telephony company Skype.

The latest annual 10K filing was the first to mention the consumer agency recommendation. A quarterly filing in July 2008, noted the data breach and users then totaling about 135,000 who had sued IAC.