Prosper prosper.com Prosper data breach: what happened and what to do
Prosper, the US personal loan marketplace, detected unauthorized access in early September 2025. Have I Been Pwned lists 17,605,276 accounts, with Social Security numbers, names, addresses, dates of birth and income details.
View all 13,115 breaches- Breach date
- Sept 2025
- Affected
- 17,605,276
- Data exposed
- Browser user agent details, Credit status information, Dates of birth, Email addresses, Employment statuses, Government issued IDs, Income levels, IP addresses, Names, Physical addresses
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
Prosper is a US marketplace for personal loans. In early September 2025, the company detected unauthorized access to its internal systems and took the affected servers offline. Have I Been Pwned (HIBP) dates the breach to 1 September 2025, added the data on 16 October 2025 and lists 17,605,276 affected accounts.
Prosper has estimated that the incident touched information about approximately 17.6 million people. It says it sent notices as state and federal rules require. It also said it saw no impact on lending or payment operations, and no sign of misuse of login credentials or account balances.
HIBP notes that about 2.8 million of the email addresses had never appeared in an earlier breach.
What was exposed
HIBP lists ten types of data. They are names, email and physical addresses, dates of birth, government issued IDs, employment and income, credit status, IP addresses and browser details. Reporting on the incident says the government IDs were Social Security numbers.
This is a loan application data set. People who applied for a loan, or who only checked a rate, may be in it. That's why it holds income, employment and credit status.
What criminals can do with it
Social Security number, date of birth and address together are the standard ingredients of identity theft. With them, someone can apply for credit in your name, file a false tax return. That's the usual list.
Income and employment details give a scammer more to work with. A call or email from a "lender" or "debt relief company" that knows your income band or employer sounds much more credible. Expect it.
Email addresses and IP details do little damage alone. Paired with the rest, they tie a person to a device and a place.
The company's response
Prosper took the affected servers offline and notified people. If you got a notice, read it for the credit monitoring offer and the deadline to enroll. Offers like this expire. If you didn't get a notice but think you applied through Prosper, use their official site to ask, not a link in an email.
What to do about a breach like this
You can't pull a Social Security number back. You can make it useless to a lender who checks your credit, and that's what a freeze does. It's free, takes about 10 minutes per bureau and doesn't hurt your score.
The slow part is staying alert. Identity theft from a data set like this can surface months later, when a collection notice or a denied application arrives. Check your credit reports a few times a year, and pay attention to mail addressed to you from lenders you never used.
What to do if you were in it
- 1
Freeze your credit at Equifax, Experian and TransUnion
A freeze blocks new credit accounts in your name. It's free and you can lift it temporarily when you apply for something.
- 2
Read your Prosper notice and use the monitoring offer
If Prosper sent you a letter or email, check it on Prosper's own site before acting on it. Enroll in any monitoring it includes before the deadline.
- 3
Watch for loan, tax and benefits fraud
Pull your free credit reports and look for accounts you didn't open. Consider an IRS Identity Protection PIN to stop a false tax return.
- 4
Treat lender and debt-relief offers with suspicion
Scammers with your income and employer can sound like the real thing. Don't give out personal details to someone who contacted you first.
- 5
Check whether your email or phone number is in this and other breaches
A free scan from Serus shows which breaches include your email or phone number. Serus monitors breach databases and the dark web and alerts you when your data shows up. It can't remove data from a breach, so the alert tells you what to change.
Frequently asked
Was I affected by the Prosper data breach?
Look up your email on Have I Been Pwned. Prosper also said it sent notices to affected people, so check your mail and email, including spam.
What was exposed?
HIBP lists names, email and physical addresses, dates of birth, government issued IDs, employment status, income, credit status information, IP addresses and browser details.
Were my Social Security number and bank details taken?
Reporting says Social Security numbers were included. Prosper said it found no misuse of account balances or login credentials.
Should I change my password?
HIBP doesn't list passwords for this breach, but it's cheap to change your Prosper password and any copy of it elsewhere.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
