REVEALED: PayPal Exposed Sensitive User Data For Six-Month Period

In a newly disclosed security incident, PayPal has confirmed that sensitive customer information was exposed for nearly six months in 2025 due to a software flaw in one of its business financing tools, raising fresh concerns data protection practices at major financial technology firms.

The breach, which affected users of PayPal’s Working Capital loan application, exposed a range of personally identifiable information (PII), including highly sensitive data such as Social Security numbers and dates of birth. The company says the issue persisted from July 1 until mid-December 2025, before being identified and remediated.

According to PayPal, the incident originated from a coding error within its PayPal Working Capital (PPWC) loan platform—a service designed to provide small businesses with streamlined access to financing.

The flaw inadvertently allowed unauthorized individuals to access customer data over an extended period. The exposed information included:

Full names Email addresses Phone numbers Business addresses Social Security numbers Dates of birth

The company discovered the issue on December 12, 2025, and acted within 24 hours to reverse the faulty code change and block further unauthorized access.

In official notifications sent to affected users, PayPal described the breach as impacting “a small number of customers,” though it has not publicly disclosed the exact scale of those affected.

PayPal acknowledged that, in some cases, the breach led directly to unauthorized financial activity. A limited number of customer accounts experienced fraudulent transactions, which the company says have since been fully reimbursed.

As part of its mitigation efforts, PayPal has:

Reset passwords for all impacted accounts Required users to create new login credentials Rolled back the problematic software update Offered two years of free credit monitoring and identity restoration services through Equifax

Customers must enroll in these protection services by June 30, 2026.

The company is also urging users to remain vigilant, advising them to regularly review account activity and credit reports for suspicious behavior. It emphasized that it does not request sensitive information—such as passwords or one-time authentication codes—via phone, email, or text, warning that phishing attempts often increase following breach disclosures.

This is not the first time PayPal has faced scrutiny over data security.

In early 2023, the company disclosed a separate breach involving approximately 35,000 accounts compromised through a credential stuffing attack—an automated method where attackers use previously leaked login credentials to gain unauthorized access.

That incident later drew regulatory attention. In January 2025, authorities in New York announced a $2 million settlement with PayPal, concluding that the company had failed to fully comply with state cybersecurity requirements, contributing to the earlier breach.

The recurrence of security-related issues may intensify pressure on PayPal to demonstrate stronger safeguards and compliance measures moving forward.

Despite its disclosures, several details the latest breach remain unclear. PayPal has not confirmed:

The exact number of affected users Whether the unauthorized access was exploited by a coordinated threat actor How the vulnerability went undetected for months

It is recommend that affected individuals—and PayPal users more broadly—take precautionary steps, including:

Enrolling in credit monitoring services Placing fraud alerts or credit freezes if necessary Updating passwords across financial accounts Being cautious of unsolicited communications

As data breaches continue to affect even the largest financial platforms, the incident serves as a reminder of the importance of proactive personal cybersecurity alongside corporate responsibility.

PayPal’s latest disclosure adds to a growing list of high-profile data exposure incidents in the financial sector, highlighting the persistent risks associated with digital financial services in an increasingly interconnected economy.

The incident underscores ongoing challenges facing fintech companies as they balance rapid product development with robust security controls. Software errors—rather than external hacking—remain a significant source of data exposure across the industry.

Even minor coding changes in financial platforms can introduce vulnerabilities if not rigorously tested, particularly in systems handling sensitive identity and financial data.

The prolonged duration of this exposure—spanning nearly half a year—may raise questions among regulators and customers alike detection capabilities and internal monitoring processes.