On December 1, 2015, a Pastebin post exposed about 1,300 email-and-password pairs and claimed they came from PayPal. The same post advertised an alleged master file containing 23,873,667,087 hacked accounts. The credentials were publicly circulated, but the available evidence did not establish that they came from PayPal or that PayPal had suffered a breach.
What was posted—and what was only claimed
CSO reported that an anonymous Pastebin post contained approximately 1,300 email addresses with corresponding passwords. It described them as PayPal credentials and included an advertising redirect link to a supposed larger file. That link was no longer available, and the download domain no longer existed. The existence and contents of the alleged master file were therefore not independently established in the reporting. CSO’s December 1, 2015 report is the central contemporary account.
The distinction matters: a public list of credentials is an exposure, but it does not by itself show that the named service was breached. The reporting does not establish that every pair was valid, unique, current, associated with PayPal, or still usable when posted.
Why the 23.87-billion figure was not credible evidence
The post claimed a total of 23,873,667,087 hacked accounts. That was an assertion by the poster, not a verified count. CSO noted that the number exceeded the world population several times over; the article also cited a 2015 PayPal figure of about 173 million active customer accounts at the time. That historical figure is not a current PayPal statistic, but it underscores how implausible the claimed total was as a count of PayPal accounts.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
No reported evidence showed that the master file existed, that its records were unique, or that they belonged to PayPal. It could have contained duplicates, invalid data, records from unrelated services, or fabricated figures; the available report could not determine which. The dead download link prevents readers from inspecting the claimed file and is a significant gap, though its disappearance alone does not prove the claim was fraudulent.
The list’s origin was unclear
According to CSO, the same list had reportedly appeared on November 28, 2015 without a PayPal attribution. Later versions described it variously as generic email-and-password pairs, PayPal accounts, or PayPal accounts connected to IMVU purchases. Different aliases—including “Madridninitoz,” “Fall9100” and “m0rg4n”—were associated with reposts. Those shifting labels and claims make a single PayPal source difficult to substantiate.
Rank #2
- PHISHING-RESISTANT 2FA: Cryptographically binds to real domains, making phishing attacks impossible unlike SMS codes or authenticator apps.
- 3-SIDE CAPACITIVE TOUCH: Tap the end, left, or right side to authenticate, so it works in any orientation or crowded USB port.
- MULTI-COLOR LED INDICATOR: Blue means ready, blinking blue means tap now, green means success, and red means error for instant status feedback.
- IP68 WATERPROOF & BATTERY-FREE: Crush-resistant one-piece construction survives daily carry on a keychain or in a bag for years without any batteries.
- UNIVERSAL COMPATIBILITY: Works with Google, Microsoft, Apple, GitHub, AWS, and any FIDO2 / U2F / WebAuthn service, storing up to 100 passkeys.
IMVU was described as a virtual social platform with its own economy and currency. CSO found no evidence that IMVU itself had been breached in this episode. The reporting also noted that one poster circulated other kinds of stolen material, which further weakens the idea that this list necessarily came from one intrusion into PayPal.
CSO said the records were added to Have I Been Pwned under breach markers dated November 28 and December 1. That reference does not establish PayPal as the source of the data; a listing of circulated credentials is not proof that the service named in a post was compromised. Have I Been Pwned is available at haveibeenpwned.com.
Rank #3
- HARDWARE 2FA AND MFA: FIDO Alliance Certified FIDO2 v2.1 with CTAP2 plus legacy U2F and CTAP1 for strong two-factor login and passwordless sign-in on services that support security keys
- BUILDING ACCESS ON ONE CARD: MIFARE DESFire EV2 4K applet with AES encryption adds office door and physical access control alongside digital authentication
- CERTIFIED SECURE ELEMENT: An NXP Common Criteria EAL6+ certified secure controller and Java Card platform protects your keys on a tamper-resistant chip
- DUAL INTERFACE SMART CARD: Contactless NFC ISO 14443 plus ISO 7816 contact reader support in an ISO 7810 ID-1 format that is passive and needs no battery
- SWISS ENGINEERED DESIGN: Built by Cryptnox as a single card for authentication and access control and backed by a 2 year warranty
What PayPal said
PayPal initially said it was checking the list. CSO later reported that PayPal’s security professionals had investigated and said reports of compromised customer accounts were inaccurate. That statement weighs against calling this a confirmed PayPal breach, but it does not establish how each credential pair was obtained or prove that no individual had reused a password that was exposed elsewhere. The reporting does not provide a complete independent forensic analysis of every record.
How credentials might have been obtained
CSO described phishing, malware-infected computers and credential reuse as more plausible possibilities than a demonstrated PayPal intrusion. These are possible explanations, not established findings about the origin of every entry:
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Password reuse: Someone could obtain a password from a different breached service and try it on PayPal or other accounts where the person reused it.
- Phishing: A deceptive sign-in page or message could trick a user into providing credentials directly.
- Malware: Malicious software on a device could capture saved or typed credentials.
- Recycled or mixed data: A list could combine old, unrelated, duplicated or invalid records and then be relabeled to attract attention.
A credential dump and a service breach are not interchangeable. Even if some credentials worked, that would not by itself reveal where they were stolen.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What users should do if a password may have been exposed
The 2015 advice to PayPal and IMVU users was to change passwords as a precaution. If a password from the list was yours—or if you used the same password elsewhere—take these steps:
Recommended Free Tools
- Change the password on every account where it was used. Start with PayPal and the email account used for PayPal recovery. Give each account a different password.
- Enable multifactor authentication where available. This adds a second verification step if someone obtains a password.
- Review PayPal activity, funding sources and recovery settings. If you find transactions or account changes you did not authorize, contact PayPal through its official support channels at PayPal’s Security Center.
- Watch for follow-up phishing. Treat unsolicited messages claiming to verify, unlock or recover an account with suspicion; use PayPal’s official site or support channels instead of links in the message.
- Use a password manager if it helps you keep passwords unique. A manager can generate and store separate passwords, but it cannot undo an exposed password: change reused credentials and secure the recovery email account yourself.
A breach-notification lookup can show whether an email address appears in known breach datasets, but a match does not prove that PayPal was the source or that a password remains valid. Nor can a password manager, malware scanner or other security product verify the historical 23.87-billion claim.
How to describe the incident accurately
- Public credential exposure: CSO reported that about 1,300 email-and-password pairs were posted.
- PayPal origin: Not established; the list circulated under conflicting descriptions.
- Claim of 23,873,667,087 compromised accounts: Unsupported by evidence in the reporting.
- Confirmed PayPal breach: Not established; PayPal said its investigation found the reports inaccurate.
The CyberWire’s December 2, 2015 daily briefing also summarized the CSO report as a questionable large-scale claim alongside a real credential-exposure concern.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
