PayPal has disclosed a data breach incident that affected its Working Capital loan application, where a software coding error led to the exposure of sensitive personal information. This breach, which lasted nearly six months from July 1 to December 13, 2025, compromised data such as names, Social Security numbers, dates of birth, email addresses, phone numbers, and business addresses.
On December 12, 2025, PayPal discovered the coding error and quickly took action by rolling back the faulty code change on the following day. The breach resulted in approximately 100 customers being directly affected, some of whom experienced unauthorized transactions. PayPal has addressed these issues by issuing full refunds for any unauthorized transactions and has reset the passwords for all impacted accounts.
To support impacted users, PayPal is providing two years of complimentary credit monitoring through Equifax. While the company has not specified the total number of affected customers beyond the initial notification, it reassures users that it is taking these security lapses seriously.
This breach highlights the significant risks associated with software errors and the importance of stringent checks in maintaining customer data security.

Collections

PayPal disclosed a data breach in its Working Capital loan application caused by a software coding error that persisted for nearly six months (July 1 to December 13, 2025). The bug exposed sensitive personal information including names, Social Security numbers, dates of birth, email addresses, phone numbers, and business addresses for approximately 100 customers, some of whom experienced unauthorized transactions. PayPal rolled back the faulty code change the day after discovery, issued full refunds for unauthorized transactions, reset affected account passwords, and is offering two years of complimentary Equifax credit monitoring to impacted users.

PayPal Data Breach Exposes Personal Information Due to Coding Error