PayPal Data Breach Exposes Users to Massive Online Fraud

Data Breach at PayPal Exposes Sensitive Customer Information

A data breach at PayPal, disclosed in recent notification letters, exposed sensitive customer information and led to unauthorized transactions.

Causes of the Breach

The incident was caused by an error in the PayPal Working Capital (PPWC) loan application, which was present from July 1 to December 13, 2025.

Compromised Data

During this period, the personal data of a small number of customers, including names, addresses, dates of birth, phone numbers, and business addresses combined with Social Security numbers, was compromised.

Consequences and Response

The vulnerability was introduced by a faulty code, which was later rolled back, and affected customers’ passwords were reset. However, the issue was exploited before it was patched, resulting in a few customers experiencing unauthorized transactions on their accounts.

Contradictory Statements

In a statement, PayPal claimed that its systems were not compromised, but this contradicts the official notification to affected users, which stated that unauthorized access to PayPal’s systems was terminated after the breach was detected.

Importance of Security Measures and Transparency

The incident highlights the importance of robust security measures and timely patching of vulnerabilities to prevent exploitation. The breach also underscores the need for transparency and clear communication with affected customers.

Lack of Clarification

PayPal has not provided further clarification on the incident, despite being reached out for comment. The company’s response to the breach has been scrutinized, with some questioning the discrepancy between its public statement and the official notification to affected users.

About Author

Vaibhav

See author's posts