Prosper prosper.com Prosper data breach: what happened and what to do
Prosper, a US peer-to-peer lending marketplace, found unauthorized activity on its systems in September 2025. Have I Been Pwned lists 17.6 million email addresses, with Social Security numbers, birth dates and addresses among the data.
View all 13,177 breaches- Breach date
- Sept 2025
- Affected
- 17,600,000
- Data exposed
- Names, Email addresses, Dates of birth, Physical addresses, Social security numbers, Government issued IDs, Employment statuses, Income levels, IP addresses, Credit status information
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
Prosper is a US peer-to-peer lending marketplace. In its notice, the company says it discovered unauthorized activity on its systems on September 1, 2025, acted to stop it, brought in an outside cybersecurity firm and told law enforcement. The data was taken through queries on its customer and applicant databases.
Prosper has not published its own count of affected people. Have I Been Pwned loaded a copy of the data and lists 17.6 million unique email addresses, added on October 16, 2025. Prosper began sending individual notifications on December 9, 2025.
Sources checked: prosper.com, consumer.ftc.gov, identitytheft.gov
Last verified against the official page:
What was exposed
Per Have I Been Pwned: names, email addresses, dates of birth, physical addresses, government-issued IDs, employment statuses, income levels, credit status information and IP addresses, plus US Social Security numbers. Prosper's notice also lists bank account numbers and driver's license numbers among the categories. Applicants who never took a loan can be included, because the data covers applicants as well as customers.
The company's response
Prosper says it found no evidence that customer accounts or funds were accessed and that its customer-facing operations were not interrupted. It offers affected people credit monitoring and identity restoration at no charge.
What to do if you were in it
- 1
Read the notice and take the free monitoring
If Prosper sent you a notice, read it for your enrollment details and sign up for the free credit monitoring and identity restoration it offers.
- 2
Freeze your credit at all three bureaus
A credit freeze is free and stops most new accounts in your name. Place it separately at Equifax, Experian and TransUnion, as the FTC explains. A fraud alert is a lighter option: it lasts one year and you only contact one bureau.
- 3
Check your credit reports
Look for accounts or inquiries you don't recognize at annualcreditreport.com, the site federal law points you to for free reports.
- 4
Expect phishing that mentions the breach
Don't click links in emails or texts about it. Go to the company's website yourself, and never share a Social Security number in reply to a message you didn't start.
- 5
Report misuse
If someone uses your identity, report it at IdentityTheft.gov to get a personal recovery plan.
- 6
Check other breaches
Run a free Serus scan to see which other breaches include your email or phone. Serus monitors breach databases and the dark web and alerts you when your details appear.
Frequently asked
Was I affected?
Check your email on Have I Been Pwned, and look for a notice from Prosper. Applicants as well as borrowers can be included.
What was exposed?
Names, email addresses, birth dates, addresses, income and employment details, government IDs and Social Security numbers, per Have I Been Pwned and Prosper's notice.
Did the attackers get into my account?
Prosper says it found no evidence that accounts or funds were accessed.
Should I change my password?
Passwords are not on the exposed list, but changing it on any financial account and turning on two-factor login is cheap, sensible hygiene.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
