PayPal Working Capital Breach Exposed SSNs and Personal Data for Six Months

PayPal is alerting customers about a significant data breach stemming from a software flaw in its PayPal Working Capital loan application. The vulnerability exposed highly sensitive personal information—including Social Security numbers, business addresses, and birth dates—from July 1 to December 13, 2025. The company detected the issue on December 12, 2025, and blocked access within 24 hours.

Technical Breakdown and Impact

According to breach notifications sent to affected users, the incident resulted from a code change that inadvertently made customer data accessible to unauthorized parties. Exposed information included:

• Full names and email addresses
• Phone numbers and business addresses
• Social Security numbers (SSNs)
• Dates of birth

PayPal confirmed that a small number of customers experienced unauthorized transactions directly linked to the breach. Those users received refunds, and the company reset passwords for all impacted accounts. Affected individuals will be prompted to create new credentials upon their next login.

Expert Analysis: Why This Breach Matters

Cybersecurity experts emphasize the severity of prolonged SSN exposure. Jake Williams, former NSA hacker and current CTO at BreachQuest, explains: "Social Security numbers are crown jewels for identity thieves. Six months of exposure creates ample time for criminals to establish fraudulent accounts or loans. Unlike passwords, SSNs can't be reset—victims face lifelong vigilance."

The breach's duration highlights critical gaps in monitoring. PayPal stated it rolled back the faulty code immediately after discovery but didn't clarify why the vulnerability went undetected since July. This incident follows PayPal's $2 million settlement with New York in 2025 over similar cybersecurity failures.

Practical Steps for Affected Users

1. Enroll in Credit Monitoring: PayPal offers two years of free three-bureau surveillance via Equifax. Enrollment must be completed by June 30, 2026, through instructions in breach notices.
2. Monitor Financial Activity: Check bank and PayPal accounts weekly for unrecognized transactions. Report anomalies immediately.
3. Review Credit Reports: Request free reports from Equifax, Experian, and TransUnion. Look for unfamiliar loans or accounts.
4. Enable Multi-Factor Authentication (MFA): Add biometric or hardware-key verification to PayPal and banking apps.

PayPal reiterated that it never requests passwords or authentication codes via phone, text, or email—a common phishing tactic following breaches. For unaffected users, this incident underscores the importance of:

• Using unique, complex passwords for financial accounts
• Regularly reviewing privacy settings in loan/fintech applications
• Considering credit freezes if handling sensitive business financing

The company hasn't disclosed the number of affected customers. BleepingComputer contacted PayPal for additional details but received no immediate response.