Yes, "the disclosure shall be made in the most expedient time possible and without unreasonable delay".

http://leginfo.legislature.ca.gov/faces/codes_displaySection...

If the breach affects more than 500 California residents, an online report must be filed with the Attorney General.

You can search breach reports, and I could not find any from ebay.

http://oag.ca.gov/ecrime/databreach/list?field_sb24_org_name...

You can also file a complaint against businesses that fail to disclose breaches here:

http://oag.ca.gov/contact/consumer-complaint-against-busines...