Some PayPal users have begun receiving emails from the company confirming a data breach that exposed personal information to a threat actor who gained access to PayPal’s systems, with some customers reporting unauthorised transactions and being required to reset their passwords.

A breach notification letter, confirmed by Forbes Senior Contributor Davey Winder, states that a hacker gained access to PayPal systems on 1 July 2025. The attacker reportedly maintained access until 12 December 2025, when PayPal discovered the incident. Notifications dated 10 February indicate that some users were impacted “due to an error in its PayPal Working Capital (“PPWC”) loan application.”

It remains unclear how the attacker’s access developed. The situation is ongoing, and PayPal has provided limited technical detail beyond attributing the issue to a “code change.”

However a statement from a PayPal spokesperson said: “When there is a potential exposure of customer information, PayPal is required to notify affected customers. In this case, PayPal’s systems were not compromised. As such, we contacted the approximately 100 customers who were potentially impacted to provide awareness on this matter.”

That statement appears to contrast with language in the breach notification, which said that after an investigation the company had “terminated the unauthorized access to PayPal’s systems.”

In its notification to affected users, PayPal said: “Upon learning about this unauthorized activity, we promptly began an investigation and took action to address this incident, including by taking steps to prevent unauthorized actors from obtaining further personal information.”

The breach notification confirms that unauthorised access persisted for approximately six months before being identified. While the number of potentially affected accounts is understood to be limited, the duration of the exposure has raised questions about detection timelines and internal monitoring processes.

According to the notifications, the information potentially accessed includes names, email addresses, phone numbers, business addresses, Social Security numbers and dates of birth.

PayPal has also confirmed that “a few customers experienced unauthorized transactions on their account,” with the spokesperson stating that around 100 individuals were affected. Refunds have already been issued to those customers.

Alerts sent on 10 February reiterated that the vulnerability affected specific customers “due to an error in its PayPal Working Capital (PPWC) loan application.”

Recommended reading

• AI-powered Phishing Attacks Hitting Inboxes Every 19 Seconds
• Hackers Hiding Phishing Sites in Split and Layered QR Codes
• Report: Phishing Kits Doubled as Cyber-crime Scaled in 2025

The company has confirmed that it blocked the intruder’s access and reset the passwords of affected users, who should have been notified via email. Customers may be prompted to create new login credentials when accessing their accounts.

To mitigate potential risks, PayPal is offering two years of free credit monitoring and identity restoration services through Equifax. Users concerned about identity theft may also consider placing fraud alerts or credit freezes with credit reference agencies.