PayPal discloses data breach that exposed user info for 6 months

PayPal is notifying customers of a data breach caused by a software error in its PayPal Working Capital (PPWC) loan application. The bug exposed sensitive personal information — including names, email addresses, phone numbers, business addresses, Social Security numbers, and dates of birth — for nearly six months, from July 1 to December 13, 2025. PayPal discovered the breach on December 12, 2025, and reversed the responsible code change the following day. A small number of affected accounts also saw unauthorized transactions, for which refunds have been issued. Affected users are being offered two years of free three-bureau credit monitoring through Equifax. PayPal has reset passwords for all impacted accounts. The company has not yet disclosed the total number of affected customers.