02/27/2026
PayPal Hit Again
(reposted from MaxPCI)
PayPal has confirmed that they have suffered another data breach. This time the target of the breach was PayPal’s Working Capital (PPWC) loan application process. The breach was first discovered on December 12, 2025. According to the breach notification, the hackers gained access to the system on July 1, 2025, after a “code change” to their application process. This means that the thieves potentially had access to their system for close to six months undetected.
PayPal has stated that they believe data from only a small number of customers was exposed during the breach, but that data included the customer’s name, email address, phone number, business address, social security numbers, and date of birth. Enough to do significant damage. “A few customers experienced unauthorized transactions on their account and PayPal has issued refunds to these customers,” PayPal said in its notification, a copy of which was submitted to authorities in Massachusetts.
While any breach is concerning, this one is particularly so because of the length of time the breach went undetected. PCI-DSS requires that at a minimum internal and external security scans are performed every 90 days, and after any major change to the system. Had those been done, the vulnerability that allowed hackers to access their system should have been discovered and patched immediately.
