PayPal has formally confirmed a safety incident that left the personal data of some customers uncovered for almost half a yr. In your data, this situation was particularly linked to the PayPal Working Capital (PPWC) service, which gives enterprise loans to small companies based mostly on their account gross sales historical past.
What occurred and when?
The difficulty started again on 1 July 2025, after a change within the software program code for the mortgage utility by accident left delicate particulars open to view. This error went unnoticed till 12 December 2025, which suggests unauthorised people probably had entry for almost six months.
Whereas the corporate’s primary safety vault remained protected, this inner code change successfully left a digital door unlocked. PayPal has since mounted the error, and a spokesperson confirmed that round 100 clients have been probably impacted.
What data was concerned?
Reportedly, the variety of folks affected is small; nevertheless, the information concerned is kind of delicate, which incorporates:
- Enterprise addresses.
- Social Safety numbers.
- Full names and dates of start.
- E mail addresses and cellphone numbers.
As we all know it, having this particular mixture of particulars stolen is a trigger of great concern as a result of it offers scammers precisely what they should open new accounts or ship very convincing pretend emails to trick small enterprise house owners.
How is PayPal responding?
PayPal formally despatched out notification letters (PDF) on 10 February 2026 to everybody affected, and reset the passwords for these accounts, so impacted customers should create a brand new one the following time they log in.
Moreover, a number of folks seen transactions they didn’t make, and PayPal has already issued full refunds to these people. To guard these clients in the long run, the corporate is providing two years of free three-bureau credit score monitoring via Equifax. This service checks your credit score historical past throughout all main businesses to identify any suspicious exercise. When you have been affected, you will need to enrol for this by 30 June 2026.
A Recurring Challenge with PayPal
This code error is only one of a number of points PayPal customers have confronted not too long ago. Hackread.com has tracked a number of different situations the place the platform has struggled with safety.
In August 2025, a significant database containing over 15.8 million PayPal-related information was marketed on the market by a hacker often called Chucky_BF. Whereas this knowledge possible got here from malware on customers’ personal units quite than a direct hit on PayPal’s servers, the size of the leak put hundreds of thousands in danger.
Then, in January 2026, a safety flaw in PayPal’s personal bill system allowed scammers to ship pretend cash requests with an official blue tick verification, bypassing most of the ordinary safety filters folks depend on.
Skilled perspective
Commenting on the state of affairs, Keven Knight, CEO of the safety agency Talion, shared an unique take with Hackread.com. He expressed concern over how the incident was dealt with, noting:
“What’s most regarding about this breach is that an organisation as giant and respected as PayPal… has waited two months to inform people about this incident. Whereas credit score monitoring has been provided, victims have been left at nighttime.”
Knight additional probed the long-term dangers, stating that whereas passwords might be modified, the attacker nonetheless has entry to private knowledge that can’t be simply up to date. He added that if the difficulty was certainly a misconfigured system, as PayPal’s claims recommend, “it’s a worrying safety error. Extra worrying nonetheless is the truth that it went unnoticed for six months. Prospects would, and will, anticipate higher.”
