The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →PayPal’s 2026 security incident appears to have been a limited data exposure involving its PayPal Working Capital loan-application system—not a confirmed compromise of PayPal’s entire network. PayPal said a coding error potentially exposed information belonging to a small number of customers between July 1 and December 13, 2025. The potentially exposed data included names, contact details, business addresses, Social Security numbers, and dates of birth.
PayPal told TechRadar that approximately 100 customers were potentially affected. That is not the same as 100 confirmed victims: the number of records actually viewed, copied, misused, or linked to fraud has not been disclosed. PayPal said a few customers experienced unauthorized transactions and were refunded.
As an Amazon Associate I earn from qualifying purchases.
If you received a breach notification, verify it through PayPal’s website or app, secure your account, review your credit reports, and be especially cautious of targeted phishing. The original deadline to enroll in PayPal’s complimentary Equifax monitoring was June 30, 2026; that deadline has passed, so contact PayPal through official support channels rather than using third-party “activation” websites.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteWhat happened at PayPal?
According to PayPal’s customer notification, an error in the code supporting the PayPal Working Capital loan-application process exposed personal information to unauthorized individuals.
#1 Best Overall
The stated exposure period was July 1, 2025, through December 13, 2025. PayPal said it identified the issue on December 12, rolled back the responsible code change, terminated unauthorized access, reset passwords for affected accounts, and added enhanced security controls.
“PayPal data breach” is understandable shorthand, but the available evidence more precisely describes an application-related data exposure. PayPal told TechRadar that its systems were not compromised. There is no evidence in the supplied notification of ransomware, a mass intrusion, or a compromise of PayPal’s entire customer database.
The PayPal breach timeline
- July 1, 2025: PayPal’s stated exposure period begins.
- December 12, 2025: PayPal says it discovered the issue.
- December 13, 2025: The stated exposure period ends.
- February 10, 2026: PayPal’s customer notification is dated.
- February 23, 2026: Public reporting from outlets including ITPro and TechRadar appears.
- June 30, 2026: The original deadline to enroll in the complimentary Equifax service.
- September 5, 2026: This article’s current date; the enrollment deadline has passed.
The exact exposure window is roughly five and a half months. Descriptions of “six months” are rounded.
Free tools Windows power users keep installed
One-click scans. No signup required.
How many PayPal customers were affected?
There are three different levels of certainty:
- PayPal’s customer letter calls the affected group a “small number” of customers.
- PayPal told TechRadar that approximately 100 customers were potentially impacted.
- PayPal has not disclosed how many records were actually accessed or copied, how many people suffered misuse, or how many accounts were involved in unauthorized transactions.
It would therefore be inaccurate to describe this as affecting millions of PayPal users—or to turn the approximate figure into an exact count of confirmed victims. Eligibility for PayPal Working Capital also does not, by itself, prove that a customer was affected.
What information may have been exposed?
PayPal said the affected information could have included:
- Name
- Email address
- Phone number
- Business address
- Social Security number
- Date of birth
The wording matters. PayPal did not say that every affected customer had every listed field exposed.
Were PayPal passwords, bank details, or card numbers exposed?
The notification does not list PayPal passwords, authentication codes, payment-card numbers, bank-account numbers, or account balances among the potentially exposed information. However, PayPal said it reset passwords for affected accounts and required affected users to establish a new password at login.
Even without exposed credentials, a combination of contact information, a business address, date of birth, and Social Security number can support convincing identity-theft or social-engineering attempts. Do not assume a message is genuine simply because it contains accurate personal or business details.
Did PayPal customers lose money?
PayPal said a few customers experienced unauthorized transactions and that those customers were refunded. It has not publicly specified the number of accounts, the total dollar amount, whether the transactions resulted directly from the exposed data, or whether any customers remain financially affected.
That means the accurate conclusion is not that PayPal users universally lost money. It is that PayPal reported a small number of unauthorized transactions and said it refunded the affected customers.
Is this the same PayPal incident reported in 2023?
No. The 2026 Working Capital exposure should not be confused with PayPal’s January 2023 notification about unauthorized access to customer accounts in December 2022.
Recommended Free Tools
| Issue | 2026 Working Capital incident | 2022 incident disclosed in 2023 |
|---|---|---|
| Apparent cause | Error in Working Capital loan-application code | Unauthorized access using existing login credentials |
| Exposure period | July 1–December 13, 2025 | December 6–8, 2022 |
| Data named | Contact information, business address, possible SSN and date of birth | Name, address, SSN or ITIN, and date of birth |
| PayPal system compromise | PayPal said its systems were not compromised | PayPal said there was no evidence the credentials came from PayPal systems |
| Financial activity | A few unauthorized transactions were reported and refunded | The notice said no unauthorized transactions were known |
The earlier incident involved account access using credentials; the 2026 event was attributed in the notification to an application coding error. They are separate events.
What has PayPal done?
PayPal said it:
- Investigated the incident.
- Terminated unauthorized access.
- Rolled back the code change.
- Reset passwords for affected accounts.
- Added enhanced security controls.
- Refunded customers who experienced unauthorized transactions.
- Offered eligible notified customers two years of complimentary Equifax credit monitoring and identity-restoration services.
The original Equifax enrollment deadline was June 30, 2026. Because that date has passed, late enrollment is not confirmed. Contact PayPal through its official Security Center or account support to ask whether any late option or alternative remedy is available. Do not search randomly for an activation code or submit your Social Security number to an unsolicited site.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What affected customers should do now
- Verify the notification. Open PayPal directly through the official app or by typing PayPal’s address into your browser. Do not use links in an unexpected email or text.
- Change your PayPal password. Use a unique password that is not used anywhere else. Change the password for the associated email account as well, and review its recovery details and forwarding rules.
- Review account security. Check recent activity, active sessions, trusted devices, email addresses, phone numbers, security settings, linked bank accounts, and payment cards. Remove anything you do not recognize.
- Enable multifactor authentication. Never share a one-time code, password, PIN, or security answer with someone contacting you.
- Check your credit reports. Use AnnualCreditReport.com, the official free-credit-report site, and look for unfamiliar accounts, inquiries, addresses, or collection activity.
- Consider a fraud alert or freeze. A fraud alert is free and can be placed with one credit bureau, which then notifies the other two. A credit freeze provides stronger protection against new-account fraud but may need to be temporarily lifted when you apply for legitimate credit.
- Watch for phishing. Be suspicious of urgent calls, emails, or texts requesting your password, authentication code, Social Security number, or a payment transfer.
PayPal’s fraud-reporting guidance also recommends changing passwords, PINs, and security questions on other accounts where appropriate, contacting financial institutions, and using the relevant credit-bureau and government reporting channels.
If you see an unauthorized transaction
- Report it immediately through the PayPal Resolution Center.
- Contact the bank or card issuer connected to the transaction.
- Save screenshots, emails, transaction IDs, dates, and support-case numbers.
- Report identity theft or fraud to the FTC.
- Consider an IC3 or police report when appropriate.
Suspicious activity is not automatically proof that the 2026 exposure caused it. Possible explanations include phishing, reused credentials, account takeover, unrelated identity theft, or a fake breach message.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Fraud alert, credit freeze, or monitoring?
| Option | What it does | Trade-off |
|---|---|---|
| Fraud alert | Warns prospective lenders to take extra steps to verify your identity | Does not block new credit by itself |
| Credit freeze | Restricts access to your credit file for most new-credit applications | Can add friction and must generally be lifted when credit is needed |
| Credit monitoring | Alerts you to some changes or activity after they occur | Is not preventive and cannot detect every type of identity theft |
These options are not interchangeable. If your concern is new-account fraud after possible exposure of an SSN and date of birth, a freeze is the strongest of the three. If you want lower-friction protection, a fraud alert may be more convenient. Free reports and alerts are available through official channels; buying a paid identity-monitoring service is not required to take the most important protective steps.
What remains unknown?
- The exact confirmed number of affected individuals.
- How many records were actually viewed, downloaded, or copied.
- Who accessed the information.
- Whether the data was published or sold.
- The total value of unauthorized transactions.
- Whether every listed data element was exposed for each affected customer.
- Whether regulators are investigating this specific incident.
- Whether PayPal will permit late enrollment in the expired Equifax offer.
Those gaps are why the incident should be taken seriously without overstating its scale or cause.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
