Breaches

PayPal Confirms Six-Month Data Exposure After Loan System Code Error Leaked Social Security Numbers

Zero Day Wire

23 Feb 2026 — 2 min read

PayPal has confirmed a data exposure incident affecting its Working Capital (PPWC) business loan service, where a software code change left sensitive customer information accessible for nearly six months before being detected.

The exposure ran from 1 July 2025 to 12 December 2025, when the error was finally discovered and remediated. Approximately 100 customers were impacted, though the sensitivity of the exposed data makes this far more significant than the headcount suggests.

What Was Exposed

The code change in the loan application system inadvertently exposed:

Social Security numbers
Full names and dates of birth
Business addresses
Email addresses and phone numbers

This combination of personally identifiable information provides everything needed for identity fraud — opening new financial accounts, applying for credit, or crafting highly targeted social engineering attacks against small business owners.

PayPal confirmed that its core security infrastructure was not compromised. The exposure was caused by an internal application-level error rather than an external breach.

Unauthorized Transactions Confirmed

Some affected customers reported unauthorized transactions on their accounts. PayPal has issued full refunds in those cases and reset passwords for all impacted accounts, requiring users to create new credentials at next login.

Notification letters were sent on 10 February 2026 — two months after the issue was discovered. The company is offering two years of free three-bureau credit monitoring through Equifax, with an enrollment deadline of 30 June 2026.

Six Months Undetected

The most concerning aspect of the incident is the detection timeline. A code change in a production loan application system exposed Social Security numbers for 164 days before anyone noticed. For a financial services company of PayPal's scale, this raises serious questions about internal monitoring, code review processes, and data access auditing.

Security experts have criticized both the detection gap and the two-month notification delay. While passwords can be reset, the exposed personal data — Social Security numbers, dates of birth — cannot be changed, leaving affected users with permanent elevated risk.

Part of a Pattern

This incident follows a series of security issues affecting the PayPal platform. In August 2025, a database containing over 15.8 million PayPal-related records was advertised for sale on cybercrime forums. In January 2026, a vulnerability in PayPal's invoice system allowed scammers to send fraudulent payment requests with verified blue-tick badges, bypassing trust indicators that users rely on to identify legitimate communications.

Defender Recommendations

Affected users should enroll in the Equifax credit monitoring immediately — do not wait until the June 2026 deadline
Place fraud alerts or credit freezes with all three bureaus as an additional precaution
Monitor for targeted phishing — the exposed data enables highly convincing social engineering specifically targeting small business owners
Review PayPal account activity for any unrecognized transactions dating back to July 2025
Organizations using PPWC should audit their own access logs and verify no downstream exposure of business data occurred

AWS Reports 600+ FortiGate Firewalls Compromised in AI-Augmented Campaign by Russian-Speaking Cybercrime Group

A financially motivated Russian-speaking cybercrime group compromised more than 600 internet-exposed FortiGate firewalls across 55 countries in just over a month, using off-the-shelf generative AI tools to scale an operation that would traditionally require a well-resourced team, according to a new incident report from AWS. The campaign, which ran from

ClickFix Campaign Compromises Legitimate Sites to Deploy MIMICRAT — A Custom C++ RAT With 22 Post-Exploitation Commands

Elastic Security Labs has disclosed a new ClickFix campaign that leverages compromised legitimate websites as delivery infrastructure to deploy a previously undocumented remote access trojan dubbed MIMICRAT (also tracked as AstarionRAT). The campaign, discovered earlier this month, demonstrates significant operational sophistication — from multi-stage PowerShell chains that bypass Windows security controls

ShinyHunters Linked to Device Code Vishing Attacks Targeting Microsoft Entra Accounts via OAuth 2.0 Abuse

A new wave of attacks is combining voice phishing (vishing) with OAuth 2.0 device authorization abuse to compromise Microsoft Entra accounts at technology, manufacturing, and financial organizations — bypassing traditional phishing infrastructure entirely. Sources told BleepingComputer they believe the ShinyHunters extortion gang is behind the campaigns, which the threat actors

Massiv Android Banking Trojan Disguised as IPTV Apps Enables Full Device Takeover for Financial Fraud

ThreatFabric has disclosed a new Android banking trojan called Massiv that masquerades as IPTV streaming apps to gain access to victims' devices, enabling full remote control and financial fraud through device takeover attacks. Although currently observed in a limited number of targeted campaigns, the malware already poses significant risk