PayPal paypal.com

PayPal data breach 2026: what happened and what to do

PayPal told a small number of PayPal Working Capital customers in February 2026 that a coding error in its loan application exposed their personal details between 1 July and 13 December 2025. The data included Social Security numbers and dates of birth. PayPal says its systems were not otherwise compromised.

View all 13,177 breaches
Breach date
Jul 2025
Made public
10 Feb 2026
Data exposed
Names, Email addresses, Phone numbers, Physical addresses, Social security numbers, Dates of birth
Last updated

Reviewed by Anthon Wansland

Head of Product & Co-Founder

Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.

What happened

PayPal sent breach notices dated 10 February 2026 to customers of PayPal Working Capital (PPWC), its small-business loan product. According to the notice letter filed with Massachusetts, PayPal found on 12 December 2025 that an error in the PPWC loan application had exposed personal information of a small number of customers. The exposure window ran from 1 July 2025 to 13 December 2025. PayPal reversed the code change the day after it found the problem.

PayPal also detected unauthorized transactions on a small number of those accounts and says it refunded them. BleepingComputer reports that passwords were reset for affected accounts.

Sources checked: mass.gov, bleepingcomputer.com, consumer.ftc.gov

Last verified against the official page:

How we research this Report an error

What was exposed

The notice and press coverage list names, email addresses, phone numbers, business addresses, Social Security numbers and dates of birth. A Social Security number plus a date of birth is what a criminal needs to apply for credit in your name, so this is a bigger risk than a leaked email address. The contact details help scammers write messages that look like they come from PayPal.

PayPal's response

PayPal offered affected customers two years of free credit monitoring and identity restoration through Equifax. The notice set a sign-up deadline of 30 June 2026, which has passed, so contact PayPal if you got a letter and didn't enrol. PayPal says it will never ask for your password or a one-time code by phone, email or text.

Was it a hack?

PayPal describes this as an internal coding error, not an attack on its systems. The notice does mention that the unauthorized access was terminated, so the line between the two isn't fully clear from the public documents.

What to do if you were in it

  1. 1

    Check whether you got a letter

    The notice went to affected PayPal Working Capital customers. If you used PPWC between July and December 2025 and got no letter, ask PayPal to confirm in writing whether you were affected.

  2. 2

    Freeze your credit

    Your Social Security number and date of birth were exposed, so place a free credit freeze at Equifax, Experian and TransUnion. The FTC explains how.

  3. 3

    Watch your accounts and credit reports

    Check your PayPal activity and bank statements for charges you don't recognize, and review your reports at annualcreditreport.com.

  4. 4

    Expect scams that mention PayPal

    Don't click links in messages about this breach. PayPal says it never asks for passwords or one-time codes by phone, email or text. Go to paypal.com yourself.

  5. 5

    Report identity theft

    If someone uses your details, report it at IdentityTheft.gov for a recovery plan.

  6. 6

    Check other breaches

    Run a free Serus scan to see whether your email or phone appears in this and other breaches.

Timeline

  1. The breach happened

  2. The company made it public

Frequently asked

Was I affected by the PayPal breach?

Only a small number of PayPal Working Capital customers were notified. If you didn't get a letter, you probably weren't, but you can ask PayPal to confirm.

What was exposed in the PayPal breach?

Names, email addresses, phone numbers, business addresses, Social Security numbers and dates of birth, according to the notice and press reports.

Should I change my PayPal password?

PayPal reset passwords on affected accounts. Changing it anyway and turning on two-factor login costs you a few minutes.

Do I need a credit freeze?

If you were notified, yes: a Social Security number and date of birth leaked. A freeze is free and the FTC recommends it when identity data is exposed.

Sources

Something wrong or out of date? Tell us and we'll re-check it.

Serus

Check if you're exposed in a breach with Serus

Find your leaks. Get alerted to new ones.

Run a free scan

Related guides

All guides
How to make your number private when you call fcc.gov How to stop spam emails consumer.ftc.gov How to opt out of prescreened credit card offers (OptOutPrescreen) optoutprescreen.com How to stop junk mail dmachoice.org

Related articles

All articles

What Happens If Your Email Is on the Dark Web – And What to Do Next

How to Get My Information Off the Dark Web

What Can Someone Do with Your Phone Number?

Cookie preferences

Choose which categories we may use. Full details for every cookie are in our Cookie Policy.

Strictly necessary

Authentication, session management, security and fraud prevention, and saving your consent choice. Always active. The site cannot function without them.

Functional

Remember preferences such as language and settings that improve your experience.

Analytics

Help us understand how the site is used, like pages visited, interactions, and performance, so we can improve it.

Marketing & advertising

Measure our marketing and deliver more relevant ads through partners such as Google, Meta, TikTok, X, and Reddit. Used only with your consent.

Your choice is saved for 12 months and applies across serus.ai, including the app. You can change it anytime from the cookie widget or the "Cookie settings" link in the footer. Withdrawing consent does not affect processing that happened before withdrawal.