Prosper Market Data Breach Affects 17.6M Individuals

Hackers appear to have stolen personal information pertaining to more than 17 million individuals from peer-to-peer lending marketplace Prosper.

A copy of the stolen data obtained by Have I Been Pwned, a free breach notification service, shows the hackers obtained 17.6 million unique mail addresses.

Exposed data included a customer’s or prospective customer’s name and date of birth, contact information including physical and email addresses, Social Security numbers, as well as details of an individual’s credit status, employment and income.

Have I Been Pwned, run by Australian developer Troy Hunt, said that 2.8 million of the exposed email addresses were new to the service, meaning they never appear to have been exposed in a data breach, or at least one that came to light publicly. The remaining 84% of email addresses appeared in previously reported breaches.

A spokesman for San Francisco-based Prosper Marketplace, the fintech that runs the online lending platform, told Information Media Group that it’s aware of Hunt’s breach count but that “we are not able to validate his claim.”

“The investigation to determine what data was affected and to whom it belongs remains ongoing,” he said. “Resolving this incident is our top priority and we are committed to sharing additional information with our customers as appropriate.”

Founded in 2005, Prosper says its peer-to-peer lending platform has originated loans with a collective total worth of $29 billion for more than 2.3 million individuals. The company also offers debt consolidation, credit cards, investment vehicles, home equity lines, as well as home, car and medical loans.

A $350 million investment round in April valued the company at nearly $20 billion.

Prosper first warned in mid-September that it detected and responded to an attack, which it appeared to have blocked by Sept. 2, after attackers stole data. The company has not stated when the attack began or how it was discovered.

“There is no evidence of unauthorized access to customer accounts and funds, and our customer-facing operations continue uninterrupted,” the company said in its first and latest breach notification, published Sept. 17. “We continuously monitor accounts and have strong safeguards in place to protect customers’ funds.”

Following the breach, the company said it was implementing additional “security controls and safeguards,” including more robust monitoring and security alerting.

The breach notification informed both customers and prospective customers: “We have evidence that confidential, proprietary and personal information, including Social Security numbers, were obtained, including through unauthorized queries made on company databases that store customer information and applicant data.”