PayPal has confirmed a data breach impacting several customers, prompting security alerts and account notifications.
The company says all affected users have been refunded.
PayPal users began receiving emails alerting them to a cyber attack that exposed personal information.
The breach reportedly occurred on July 1, 2025, when a threat actor gained access to certain PayPal systems, leading to unverified transactions and some password resets.
Despite the incident, PayPal stated that its systems were not fully compromised and only approximately 100 users were potentially affected.
What information was exposed?
The company confirmed that hackers accessed sensitive customer data, including:
-
Full name
-
Email address
-
Phone number
-
Business address
-
Social Security number
-
Date of birth
-
Other personal details
Additionally, a few users reported unauthorized transactions, which PayPal has since refunded.
PayPal’s response
A spokesperson for PayPal emphasized transparency, stating:
"When there is a potential exposure of customer information, PayPal is required to notify affected customers. In this case, PayPal’s systems were not compromised. As such, we contacted the approximately 100 customers who were potentially impacted to provide awareness on this matter."
The company has urged all users to remain vigilant, monitor account activity, and update passwords as a precaution.
What customers should do
Even though refunds have been issued, users are advised to:
-
Check account statements for unusual activity
-
Update PayPal passwords and enable two-factor authentication
-
Be wary of phishing emails claiming to be from PayPal
The incident underscores the ongoing need for cybersecurity vigilance in online financial services.
