PayPal did not agree to distribute $2 million to affected customers. On January 23, 2025, the New York State Department of Financial Services (NYDFS) announced that PayPal, Inc. agreed to pay a $2 million civil monetary penalty over cybersecurity failures connected to a December 2022 credential-stuffing incident. The money goes to New York State, and the consent order does not identify a consumer claims process.
The incident affected approximately 35,000 PayPal accounts, according to PayPal’s 2023 disclosure as reported by BleepingComputer. Information accessible through affected accounts could include names, dates of birth, postal addresses, Social Security numbers and individual taxpayer-identification numbers.
As an Amazon Associate I earn from qualifying purchases.
What PayPal agreed to pay
The payment is best understood as a regulatory penalty, not a private class-action settlement. Under the NYDFS consent order, PayPal agreed to pay $2 million within 10 days of the order’s effective date.
The order also says PayPal may not claim a federal, state or local tax deduction or credit for the penalty and may not seek reimbursement or indemnification for it, including through insurance. The NYDFS announcement and order do not say that the money will be divided among affected users.
#1 Best Overall
Can PayPal users claim part of the $2 million?
No consumer claim process is identified in the NYDFS order. Nothing in the cited regulatory materials says that every affected customer will receive money, that users can file claims for a share of the penalty, or that the payment creates a compensation fund.
Readers should be cautious with websites advertising a “PayPal settlement claim.” Do not pay a third party to obtain money from this NYDFS penalty. Use PayPal’s official website or app for account questions and government resources such as IdentityTheft.gov for identity-theft guidance.
What happened between December 6 and 8, 2022?
Attackers used credential stuffing: automated attempts to log in with usernames and passwords obtained from other breaches or services. The technique works when people reuse passwords across accounts. It is different from saying that attackers exploited a single software flaw to break into PayPal’s entire corporate network.
Recommended Free Tools
PayPal later disclosed that approximately 35,000 accounts were affected. A successful account takeover could expose information available inside the account, including tax documents. The public reporting supports unauthorized access to affected accounts; it does not establish that all PayPal customers or all PayPal systems were compromised.
Why Form 1099-K documents mattered
NYDFS said PayPal had changed how IRS Form 1099-K documents were delivered after changes to tax-reporting requirements. The employees implementing the change were not adequately trained on PayPal’s systems and application-development processes, and the change was misclassified under internal procedures.
As a result, required risk and control checks were not completed before the change went live. The forms were available without adequate masking, so attackers who used compromised credentials could access highly sensitive tax information.
This was not simply a “1099-K bug.” NYDFS linked the exposure to the poorly managed data-flow change alongside broader weaknesses in training, change management, identity controls, authentication and access controls.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →What information may have been exposed?
According to NYDFS, the potentially exposed information included:
- Full names
- Dates of birth
- Postal addresses
- Social Security numbers
- Individual taxpayer-identification numbers
- Information contained in IRS Form 1099-K documents
These categories describe information that could have been accessible through affected accounts. They do not mean that every affected account contained every listed data element or that every affected customer had a Social Security number exposed.
What NYDFS said PayPal did wrong
The consent order resolved NYDFS findings under New York’s Cybersecurity Regulation. It cited provisions including 23 NYCRR §§ 500.3, 500.10 and 500.12. The order and NYDFS announcement identified failures involving:
- Inadequate cybersecurity training.
- Insufficiently qualified personnel performing key cybersecurity functions.
- Improper classification and assessment of a significant system change.
- Failure to complete required risk and control procedures before deployment.
- Weak written policies concerning access controls, identity management and customer data.
- Insufficient controls to prevent unauthorized access to nonpublic information.
- No mandatory multifactor authentication for customer accounts at the time.
- Insufficient protections against automated login attempts, including CAPTCHA and rate limiting.
These are regulatory findings resolved through a consent order, not findings reached after a trial. The distinction matters: the case focused on PayPal’s cybersecurity program and controls as well as the account compromises themselves.
Free tools Windows power users keep installed
One-click scans. No signup required.
What PayPal changed afterward
NYDFS said PayPal remediated the identified issues and improved its practices. Reported measures included masking sensitive information on IRS forms, implementing CAPTCHA, adding rate limiting and making multifactor authentication mandatory for U.S. customer accounts.
Those changes should not be confused with a consumer-remediation program. The public materials describe security improvements and a regulatory penalty, not direct compensation for affected users.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What PayPal users should do now
- Change reused passwords. Create a unique PayPal password and change the same password anywhere else it was used. A password manager can help generate and store unique credentials.
- Turn on MFA. Use PayPal’s current security settings to enable multifactor authentication. MFA can make credential stuffing harder, although it is not an absolute guarantee against account takeover.
- Review account activity. Check recent transactions, linked cards and bank accounts, account-login alerts and contact details. Report suspicious activity through PayPal’s official app or website.
- Watch for phishing. Be especially skeptical of messages about tax forms, refunds, account recovery or a supposed settlement. Do not use links in unexpected messages.
- Check your credit reports. Visit AnnualCreditReport.com, the official source for free U.S. credit reports.
- Consider a fraud alert or credit freeze. A U.S. credit freeze is free and can help prevent new creditors from opening accounts in your name. It may be more directly useful than paying for monitoring when Social Security information is at risk.
Do not assume that purchasing identity-monitoring software is necessary to access the NYDFS penalty; the penalty does not appear to create such a requirement or a customer payout process.
Key dates
| Date | Event |
|---|---|
| December 6–8, 2022 | Credential-stuffing activity affected PayPal accounts. |
| January 18, 2023 | PayPal publicly announced the data breach, according to contemporaneous reporting. |
| 2023 | PayPal disclosed that approximately 35,000 accounts were affected. |
| January 23, 2025 | NYDFS announced the $2 million penalty and published the consent order. |
| Within 10 days of the order’s effective date | PayPal was required to pay the penalty. |
Bottom line
PayPal’s $2 million payment was a New York regulatory penalty over cybersecurity failures related to the 2022 credential-stuffing incident. It was not presented as a nationwide consumer settlement, and the NYDFS order does not provide a claims process or automatic payment for PayPal users. Affected or concerned customers should focus on unique passwords, MFA, account monitoring, phishing awareness and—when appropriate—a free credit freeze.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
