PayPal

Disclosed Jan 18, 202334,942 affectedConfirmed

Credential stuffing attack exposes Social Security numbers in PayPal accounts

PayPal notified customers that unauthorized parties logged into accounts with valid credentials obtained elsewhere between December 6 and 8, 2022. They could view names, addresses, Social Security or tax ID numbers and dates of birth; PayPal reset the affected accounts' passwords.

What is known

People affected	34,942 (as reported by the organization)
Disclosed	Jan 18, 2023
Discovered	Dec 8, 2022
Happened	Dec 6, 2022
Attack	Credential stuffing
Data exposed	NamesAddressesSocial Security numbersDates of birth
Sector	Finance · US
Status	Confirmed

Sources

Official noticeoag.ca.gov

California Attorney General breach notice: PayPal

Official noticeatg.wa.gov

Washington Attorney General breach notice: PayPal

Official noticejustice.oregon.gov

Oregon DOJ breach notice: PayPal

Regulatoroag.ca.gov

California AG data breach notice: PayPal, Inc.

Official noticein.gov

Indiana Attorney General 2023 data breach report: Paypal

Notices filed

Residents of CAJan 18, 2023

California AGCount not stated

Residents of WAJan 18, 2023

Washington AG890 people

Residents of ORJan 18, 2023

Oregon DOJ34,942 people

TotalJan 18, 2023

ResearchCount not stated

Residents of INJan 18, 2023

Indiana AG824 people

Other breaches at PayPal

PayPal Working Capital code error exposed SSNs of about 100 customersExposed data exposed names, emails, phone numbers, addresses, Social Security numbers and dates of birth.Exposed data100 affectedFinanceUSUnverifiedFeb 20

History of this record

records_basis2026-09-25

empty to organizationby backfillSource

records2026-09-25

empty to 34942by backfillSource

attack2026-09-25

hacking to credential-stuffingby seedSource

data_types2026-09-25

[] to ["names","addresses","ssn","dob"]by seedSource

summary2026-09-25

empty to PayPal notified customers that unauthorized parties logged into accounts with valid credentials obtained elsewhere between December 6 and 8, 2022. They could view names, addresses, Social Security or tax ID numbers and dates of birth; PayPaby seedSource

title2026-09-25

empty to Credential stuffing attack exposes Social Security numbers in PayPal accountsby seedSource

attack2026-09-25

unknown to hackingby backfillSource

discovered2026-09-25

empty to 2022-12-08by backfillSource

Added2026-09-25

First recordedby backfillSource

First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.

Everything about PayPal