In December 2022, PayPal experienced a data breach involving unauthorized account access through credential stuffing. Hackers were unable to transact, and PayPal promptly reset the passwords of affected accounts. The breach exposed users' personal information highlighting the risks associated with reusing passwords across multiple accounts.

How many accounts were compromised?

The breach compromised data for approximately 35,000 users.

What data was leaked?

The data exposed in the breach included email addresses, Social Security Numbers, employers, geographic locations, job titles, names, phone numbers, and social media profiles.

How was PayPal hacked?

In the PayPal breach, hackers utilized credential stuffing to gain unauthorized access to users' accounts, exploiting the fact that many individuals reuse the same password across multiple platforms. By employing stolen usernames and passwords, the attackers were able to access sensitive personal information, including Social Security Numbers, without directly compromising PayPal's security systems.

PayPal's solution

In response to the hack, PayPal implemented several security measures to protect its users and prevent future incidents. The company promptly reset the passwords of affected accounts, requiring users to establish new passwords upon their next login. While specific enhanced security protocols were not disclosed, PayPal's actions demonstrate their commitment to safeguarding user information and addressing vulnerabilities exposed by the breach.

How do I know if I was affected?

PayPal reached out to affected users following the breach. If you're a PayPal user and haven't received a notification, you may visit Have I Been Pwned to check if your email has been compromised in a data breach.

What should affected users do?

In general, affected users should:

1. Change Your Password: Immediately update your password for the breached account. Make sure the new password is strong and unique, not previously used on any other platform.

2. Reset Passwords for Other Accounts: If you've used the same or similar passwords for other online accounts, reset those as well. This is crucial as attackers often try using stolen passwords on multiple sites.

3. Enable Two-Factor Authentication (2FA): Activate 2FA on the breached account. Consider enabling this additional security feature on all other important online accounts to significantly reduce the risk of unauthorized access.

4. Monitor Your Accounts: Keep an eye on your accounts for any suspicious activity and report any unauthorized transactions immediately.

For more specific help and instructions regarding PayPal's data breach, please contact PayPal Contact Us directly.

Where can I go to learn more?

If you want to find more information on the PayPal data breach, check out the following news articles:

• The PayPal Breach – Who Was Affected and How You Can Protect Yourself