PayPal notifies customers of data breach that exposed SSNs and more for nearly 6 months

(Image credit: Shutterstock)

PayPal has started notifying business customers of a data breach that exposed personal information, including Social Security numbers, for six months in 2025. The breach lasted from July 1 through December 12, 2025.

Specifically, it affected users of the PayPal Working Capital (PPWC) loan app that provides small businesses with loans. Apparently, there was a software error in the loan application.

PayPal said in its breach notification letter that it discovered the breach on December 12 and immediately reversed the code that caused it, blocking bad actors' access the following day. According to the payment company, the breach exposed customers' names, email addresses, phone numbers, SSNs, and dates of birth.

"On December 12, 2025, PayPal identified that due to an error in its PayPal Working Capital ("PPWC") loan application, the PII of a small number of customers was exposed to unauthorized individuals during the timeframe of July 1, 2025, to December 13, 2025," the letter says.

PayPal told Bleeping Computer that only 100 customers were affected, even as it detected unauthorized transactions resulting directly from the breach. The company reset passwords for impacted accounts.

Third breach in the same six month window

PayPal building — (Image credit: PayPal)

While this data breach was small in the number of impacted individuals, it was part of a six-month trend of breaches suffered by PayPal in 2025.

In August of last year, a dataset that allegedly contained nearly 16 million stolen PayPal credentials, including login emails and passwords. PayPal denied that the breach was new and the exposed information was from a "security incident" in 2022. The company was ordered to pay a $2 million fine by the New York State Department related to the 2022 incident.

The dataset was leaked by cybercriminals on dark web forums in early August, and security researchers noted that much of the information may have already been exploited, lending credence to its age.

In September, we reported that a new phishing scam meant to steal funds and take over PayPal accounts. The scam was sending emails to PayPal account holders, attempting to get them to input their information using malicious links. At the time, it appeared that the scam had been active for over a month.

How to stay safe

laptop anger — (Image credit: Shutterstock)

Again, this breach was allegedly very small in raw numbers. However, it's still a good reminder that we need to practice strong security hygiene.

For those who do find themselves impacted, PayPal is offering complimentary credit monitoring services via Equifax. With SSNs and other identifying information exposed, it's a good idea to invest in one of the best identity theft protection services. These services will alert you if your data appears online, help recover funds lost to fraud and walk you through restoring accounts and credit.

They do work best if you enroll before a breach, but it can't hurt to do so after one occurs.

Bad actors might use your data to gain access to more accounts and funds. Be sure to double-check any emails, especially those from PayPal. Do not click on any links in suspicious emails and instead go to the source.

Additionally, make sure that you enable two-factor authentication (2FA) to add an extra layer of security for your online accounts to prevent scammers from accessing them.

Finally, you want to protect your devices from the latest cyber threats by making sure you have one of the best antivirus programs installed and up-to-date on your computer. You also want to make sure that you're familiar with all of its features that can help you stay safe online, like a VPN or a hardened browser.

Follow Tom's Guide on Google News and add us as a preferred source to get our up-to-date news, analysis, and reviews in your feeds.

More from Tom's Guide

Scott Younker is the West Coast Reporter at Tom’s Guide. He covers all the lastest tech news. He’s been involved in tech since 2011 at various outlets and is on an ongoing hunt to build the easiest to use home media system. When not writing about the latest devices, you are more than welcome to discuss board games or disc golf with him. He also handles all the Connections coverage on Tom's Guide and has been playing the addictive NYT game since it released.

You must confirm your public display name before commenting

Please logout and then login again, you will then be prompted to enter your display name.