PayPal Ties Small Data Breach and Fraud to App Coding Error

Financial services firm PayPal said it discovered a data breach that lasted for six months, exposed some business customers’ personal information and led to fraudulent charges.

See Also: New Attacks. Skyrocketing Costs. The True Cost of a Security Breach.

The company said about 100 customers were affected by the data exposure, which it tied to an “error” in its PayPal Working Capital loan application, which is designed to provide business financing of up to $200,000 for first-time borrowers and $300,000 for repeat borrowers.

San Jose, California-headquartered PayPal remains one of the world’s dominant financial technology providers. The fintech processed $1.7 trillion in 2024, when it counted 434 million active accounts and reported $31.8 billion in net revenue, according to its latest annual report.

“When there is a potential exposure of customer information, PayPal is required to notify affected customers,” the company said in a statement. “In this case, PayPal’s systems were not compromised. As such, we contacted the approximately 100 customers who were potentially impacted to provide awareness on this matter.”

The company told affected customers in a Feb. 10 breach notification posted online by BleepingComputer that after spotting “unauthorized activity,” it immediately “began an investigation and terminated the unauthorized access to PayPal’s systems.”

In addition, “we reset the passwords of the affected PayPal accounts and implemented enhanced security controls that will require you to establish a new password the next time you log in to your account if you have not already done so,” the breach notification said.

PayPal said it first identified the underlying error in its PPWC app on Dec. 12, 2025, and said that the data exposure ran last year from July 1 through Dec. 13.

Personally identifiable information exposed by the app flaw included a business account holder’s contact information – name, business address, email address and phone number – plus their Social Security number and date of birth, according to the breach notification.

“PayPal has since rolled back the code change responsible for this error, which potentially exposed the PII,” it said. “A few customers experienced unauthorized transactions on their account and PayPal has issued refunds to these customers.”

The company didn’t immediately respond to a request for comment about how this fraud occurred, and if it was due to account holders’ passwords being exposed and used by others.

PayPal is offering all affected customers two years of prepaid identity theft monitoring.

This isn’t the first PayPal data breach. In January 2023, the company said it was notifying nearly 35,000 customers that an attacker accessed their accounts over a three-day period in December 2022.

“It is likely that the unauthorized party obtained the login credentials via phishing or related activity, unrelated to PayPal,” it said at the time, adding that “there is no evidence that the account login credentials were obtained from PayPal’s systems.”

The company said credential stuffing – when an attacker reuses stolen or leaked username and password pairs for other services – apparently led to that breach. Such attacks can succeed when someone reuses the same password across multiple services. Alternately, attackers can trick a victim into entering the information into a phishing page designed to look like a legitimate log-in screen (see: Breach Roundup: Phony Chinese Sites Mimic Retail Brands).

For blocking such attacks, PayPal offers optional multifactor authentication using a one-time password sent through SMS, WhatsApp or email, or relayed through an automated phone call. The service also offers MFA by using an authenticator app, which is a much more secure alternative, as well as to use passkeys that get tied to a specific device and which can only be unlocked with a fingerprint or facial recognition check.

If activated, either the MFA authenticator or passkey protection will typically block outright attempted credential stuffing attacks.