PayPal disclosed a significant data exposure incident involving its PayPal Working Capital (PPWC) loan application, where sensitive customer information was accessible for nearly six months.
Key Details of the Incident
- Duration: The exposure occurred between July 1, 2025, and December 13, 2025.
- Cause: The incident was triggered by a coding error within a software update to the PPWC platform, not a direct hack of PayPal’s core systems.
- Impact: Approximately 100 customers were affected. Some of these users experienced unauthorized transactions, for which PayPal has since issued refunds.
- Exposed Data: The leaked information included full names, business addresses, email addresses, phone numbers, Social Security numbers, and dates of birth.
PayPal’s Response
PayPal discovered the issue on December 12, 2025, and rolled back the faulty code the following day to block further access. Affected users were notified via formal letters in February 2026.
As a remedial measure, PayPal has:
- Reset passwords for all impacted accounts.
- Offered two years of free credit monitoring and identity restoration services through Equifax.
- Urged users to remain vigilant against phishing attempts. For more security advice, users can visit the PayPal Security Center.
