PayPal paypal.com PayPal data breach 2022: what happened and what to do
Between December 6 and 8, 2022, attackers logged into 34,942 PayPal accounts using passwords stolen elsewhere. They could see names, addresses, phone numbers, dates of birth and Social Security or tax ID numbers. PayPal says its own systems weren't breached.
View all 13,115 breaches- Breach date
- 6 Dec 2022
- Made public
- 18 Jan 2023
- Affected
- 34,942
- Data exposed
- Names, Physical addresses, Phone numbers, Dates of birth, Social security numbers
- Last updated
PayPal's December 2022 incident was a credential stuffing attack: criminals took email and password pairs leaked from other sites and tried them on PayPal until some worked. PayPal says its systems weren't breached. The attackers got in through real customer logins.
What happened
According to PayPal's notice to the Maine Attorney General, the unauthorized logins happened between December 6 and December 8, 2022. PayPal confirmed the incident on December 20, 2022 and reported a total of 34,942 people affected. It started sending notices in mid-January 2023, and the California Attorney General's listing records the incident under a December 6, 2022 date.
PayPal's letter said the attackers most likely got the passwords through phishing or similar methods, since it found no sign that its own network was breached. It reset the passwords of affected accounts and told customers what to do. PayPal also said it had no information suggesting the data was misused and had seen no unauthorized transactions on the affected accounts.
What was exposed
With a working login, an attacker could see what the account page shows. PayPal's notice lists:
- Full names
- Home addresses
- Phone numbers
- Dates of birth
- Individual tax identification numbers or Social Security numbers
That list matters more than the count suggests. 34,942 is a small share of PayPal's customer base, but for the people involved the exposed combination of name, address, date of birth and Social Security number is exactly what an identity thief needs.
Why credential stuffing works
People reuse passwords. When a small shop or forum gets breached, its login data circulates, and criminals try each pair against large sites such as banks, shops and payment services. The attack doesn't need any flaw in the target's code, only reuse. If a password you use in one place has ever leaked, every account that shares it is open to the same trick.
What PayPal did
PayPal reset the passwords of the affected accounts and notified the people involved by letter. It also told regulators it had found no evidence of misuse or unauthorized transactions on those accounts. That is the company's statement as of its notice, and it doesn't rule out later misuse, since a stolen Social Security number can sit unused for months before someone tries it. If you got the letter, read it closely and keep it with your records, and check your credit reports on a regular schedule for a year or two.
What it means for you
If you didn't get a letter, you're not in the 34,942, but the lesson applies to every account you own. Use a different password for each, keep them in a password manager, and turn on two-factor authentication, ideally with an authenticator app rather than text messages.
What to do if you were in it
- 1
Change your PayPal password and any you reused
Use a long, unique password for PayPal. Check other accounts that share it, starting with your email, because email can reset everything else.
- 2
Turn on two-factor authentication
In PayPal, open Settings, then Security, and turn on two-step verification. An authenticator app is safer than text messages against SIM swap fraud.
- 3
Freeze your credit at all three bureaus
A credit freeze stops anyone from opening new credit in your name. It's free and takes about 10 minutes at each of Equifax, Experian and TransUnion. You can lift it for a day when you apply for a loan. This matters if your Social Security number or tax ID was in the letter.
- 4
Keep the PayPal letter if you got one
File it with your records and follow any steps it lists. It's useful proof of when you were notified if you ever need to dispute a fraudulent account.
- 5
Review recent PayPal activity and linked cards
Look for logins and payments you don't recognize, and remove any linked bank or card you no longer use.
- 6
Check whether your email or phone is in this and other breaches
Run a free Serus scan to see which breaches include your email address or phone number. Serus monitors breach databases and the dark web and alerts you when your data appears, so you hear about the next one early.
Frequently asked
How many PayPal accounts were affected?
PayPal told the Maine Attorney General that 34,942 people were affected.
Was PayPal hacked?
PayPal says its systems weren't breached. Attackers used passwords stolen elsewhere to log in to customer accounts, a technique called credential stuffing.
What information was exposed?
Names, addresses, phone numbers, dates of birth and Social Security or individual tax identification numbers.
Should I change my PayPal password?
Yes, if you reuse it anywhere or haven't changed it in a long time. Use a unique password and turn on two-factor authentication.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
