PayPal Data Breach Exposes Customers’ Personal Information

Recently, PayPal notified its customers of a data breach that occurred due to a software error in their loan application, exposing sensitive personal information, including Social Security numbers, for nearly six months last year. The breach affected the PayPal Working Capital (PPWC) loan app, which offers quick financing options for small businesses.

On December 12, 2025, PayPal discovered the breach and found that customers’ names, email addresses, phone numbers, business addresses, Social Security numbers, and dates of birth were exposed from July 1, 2025. The company took immediate action to address the issue by reversing the code change that caused the breach, preventing further unauthorized access to the data.

PayPal also detected unauthorized transactions on some customers’ accounts as a result of the breach and issued refunds to those affected. To further assist impacted users, PayPal is offering two years of free credit monitoring and identity restoration services through Equifax, with enrollment required by June 30, 2026.

Customers are advised to monitor their credit reports and account activity for any suspicious transactions. PayPal emphasized that they never ask for account passwords or authentication credentials via phone, text, or email, to protect users from phishing attacks.

In a previous incident in January 2023, PayPal informed customers of a data breach resulting from a credential stuffing attack that compromised 35,000 accounts. Subsequently, in January 2025, New York State reached a $2,000,000 settlement with PayPal over cybersecurity regulation violations related to the 2022 breach.

Update February 20, 11:38 EST: A PayPal spokesperson clarified that the recent incident did not involve a breach of the company’s systems but exposed data of approximately 100 customers. PayPal proactively contacted these customers to raise awareness of the situation.

See also  Enhanced Security Alert: Windows PowerShell Now Notifies Users of Invoke-WebRequest Script Risks

Modern IT infrastructure operates at a pace that manual workflows struggle to match. Learn how automated responses can reduce delays, enhance reliability, and create intelligent workflows in the new Tines guide.

Get the guide