PayPal paypal.com PayPal Working Capital data breach: what happened and what to do
PayPal said a software error in its PayPal Working Capital loan app exposed data of about 100 customers from 1 July to 12 December 2025: names, emails, phone numbers, business addresses, Social Security numbers and dates of birth.
View all 13,177 breaches- Breach date
- Jul 2025
- Made public
- 10 Feb 2026
- Affected
- 100
- Data exposed
- Names, Email addresses, Phone numbers, Physical addresses, Social security numbers, Dates of birth
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
PayPal found on 12 December 2025 that an error in its PayPal Working Capital (PPWC) loan application had exposed personal information of a small number of customers to unauthorized people. According to PayPal's notice filed in Massachusetts, dated 10 February 2026, the exposure began on 1 July 2025. PayPal says the cause was a code change, not a break-in to its systems, and that it reversed the change the day after finding the problem. PYMNTS reports PayPal notified about 100 customers.
Sources checked: mass.gov, pymnts.com, techrepublic.com
Last verified against the official page:
What was exposed
The exposed data was business contact details (name, email address, phone number and business address), plus Social Security numbers and dates of birth. TechRepublic reports that a few customers saw unauthorized transactions on their accounts and that PayPal refunded them.
What it lets criminals do
A Social Security number together with a date of birth and a name is what someone needs to apply for credit in your name. The phone number and email give scammers a way to contact you with messages that mention PayPal. PayPal also reset passwords for affected customers, so a message asking you to "confirm" a password reset deserves suspicion.
PayPal's response
PayPal sent notice letters and offered two years of free credit monitoring and identity restoration through Equifax, according to press coverage of the notice. Check your letter for the enrollment deadline.
What to do if you were in it
- 1
Freeze your credit
Your Social Security number was exposed, so place a free credit freeze at Equifax, Experian and TransUnion. The FTC explains how.
- 2
Take the free credit monitoring
If you got a PayPal letter, enroll before the deadline in it. Monitoring alerts you to new activity; a freeze is what blocks new accounts.
- 3
Check your PayPal and bank activity
Look for transactions you don't recognize and dispute them with PayPal or your bank quickly.
- 4
Expect messages that mention PayPal
Don't click links in emails or texts about your account or a password reset. Open the PayPal app or type the address yourself.
- 5
Report misuse
If someone opens credit in your name, report it at IdentityTheft.gov to get a recovery plan. You can also run a free Serus scan to see which other breaches include your email or phone.
Timeline
-
The breach happened
-
The company made it public
Frequently asked
Was I affected by the PayPal Working Capital breach?
PayPal says it notified the roughly 100 customers affected by letter. If you didn't get one, PayPal's notice suggests you weren't among them.
What was exposed?
Name, email address, phone number, business address, Social Security number and date of birth, per PayPal's notice.
Should I change my PayPal password?
PayPal reset passwords for affected customers. Choosing a new unique password and turning on two-factor login is still a sound habit.
Sources
- mass.gov/doc/2026-240-paypal-inc/download
- pymnts.com/cybersecurity/2026/paypal-working-capital-security-lapse-exposes-data-of-100-users
- techrepublic.com/article/news-paypal-working-capital-data-exposure-2025/
- consumer.ftc.gov/articles/what-know-about-credit-freezes-and-fraud-alerts
- identitytheft.gov/databreach
Something wrong or out of date? Tell us and we'll re-check it.
