PayPal has confirmed that a software error in its PayPal Working Capital loan application exposed sensitive customer information, including Social Security numbers, for nearly six months.
Quick Summary – TLDR:
- Personal data including SSNs and dates of birth was exposed from July 1 to December 13, 2025.
- The issue stemmed from a software coding error in the PayPal Working Capital loan app.
- Around 100 customers were potentially impacted, according to PayPal.
- Affected users are being offered two years of free credit monitoring through Equifax.
What Happened?
PayPal disclosed that a coding error inside its PayPal Working Capital loan application left sensitive personal data accessible to unauthorized individuals for about 165 days. The company discovered the issue on December 12, 2025, and rolled back the faulty code the next day, blocking further access.
Formal notification letters were sent to affected users on February 10, 2026. PayPal stated that the delay was not due to any law enforcement investigation.
‼️ PayPal Confirms Data Breach Left User Information Exposed for Six Months 😂https://t.co/498ZrB0XGN
— Dark Web Informer (@DarkWebInformer) February 20, 2026
“On December 12, 2025, PayPal identified that due to an error in its PayPal Working Capital (“PPWC”) loan application, the PII of a small number of customers was exposed to…
Six Months of Data Exposure
The breach affected customers who applied for financing through PayPal Working Capital, a product designed to provide small businesses and sole proprietors with quick access to loans.
According to the company’s notification, the exposed data may have included:
- Full names
- Email addresses
- Phone numbers
- Business addresses
- Social Security numbers
- Dates of birth
This combination of data is particularly sensitive because it creates a clear path for identity theft, account takeover attempts, and targeted phishing attacks.
In its breach notice, PayPal said:
Unauthorized Transactions Reported
PayPal confirmed that a limited number of customers experienced unauthorized transactions as a direct result of the exposure. The company said it has issued refunds to those affected.
All impacted accounts had their passwords reset. Users who have not already updated their login credentials will be required to do so during their next sign in.
A spokesperson told Cyber Press:
Notably, PayPal emphasized that its core systems were not breached and that the incident was caused by an internal software issue rather than an external hack.
Free Credit Monitoring Offered
To mitigate the risk, PayPal is offering affected users two years of complimentary three bureau credit monitoring and identity restoration services through Equifax. Customers must enroll before June 30, 2026, using a unique activation code provided in their notification letter.
The monitoring package includes:
- Daily access to Equifax credit reports
- Three bureau credit monitoring with email alerts
- Dark web scanning for Social Security and financial account numbers
- Automatic fraud alerts
- Up to $1,000,000 in identity theft insurance
PayPal is also urging customers to monitor their credit reports and account activity for suspicious behavior. The company reminded users that it never asks for passwords, one time codes, or authentication credentials through phone calls, text messages, or email.
A History of Security Scrutiny
This is not the first time PayPal has faced cybersecurity challenges. In early 2023, the company disclosed that 35,000 accounts were compromised in a credential stuffing attack that occurred in December 2022.
In January 2025, New York State announced a $2,000,000 settlement with PayPal over allegations that it failed to comply with state cybersecurity regulations tied to that earlier breach.
While PayPal maintains that this latest incident was limited in scope, the exposure of Social Security numbers, even for a small group of users, raises ongoing concerns about data protection in financial technology platforms.
SQ Magazine Takeaway
Here is my honest take. When a fintech giant like PayPal says only about 100 customers were affected, that sounds small. But when Social Security numbers and dates of birth are involved, even one exposed record is serious. Small business owners rely on PayPal for fast financing. They should not have to worry about identity theft because of a coding mistake.
This incident shows that even internal software errors can create real world consequences. Companies handling financial data must treat every line of code as critical infrastructure.
