PayPal Working Capital breach exposed SSNs for months

Online payment platforms manage extremely sensitive financial identity data. A recently disclosed PayPal Working Capital breach shows how a small application error can expose that data for months without detection.

The issue affected PayPal’s business lending service rather than the main consumer wallet. Even so, attackers accessed highly valuable identity information, including Social Security numbers. Exposure lasted long enough to create real identity theft risk.

The incident demonstrates a common modern security failure. Systems may remain intact while application behavior silently leaks protected information.

What happened

PayPal detected suspicious activity in December 2025. Investigation later revealed the exposure began in early July and continued for nearly six months.

A backend code update changed how the Working Capital application handled requests. Attackers discovered the flaw and used it to retrieve customer records through legitimate application functionality. They did not break encryption or penetrate infrastructure.

Instead, they queried data through a valid logic path that should never have been accessible externally. Because the requests appeared normal, traditional intrusion alerts did not trigger.

Around 100 customers were affected.

What information was exposed

The attackers accessed personal and business identification details. This type of data enables long-term fraud even without direct financial theft.

Exposed information included:

• Full name
• Social Security number
• Date of birth
• Email address
• Phone number
• Business address

Some users later noticed unauthorized transactions, which PayPal reversed. However, identity data cannot be reset the same way a password can.

Why the breach matters

The PayPal Working Capital breach highlights a growing category of attacks. Criminals increasingly exploit business logic instead of hacking servers.

This method creates several problems:

• Monitoring systems see normal activity
• Security teams struggle to detect exposure
• Data leaks continue for long periods
• Damage appears months after the incident

Identity attributes allow criminals to open accounts, request loans, or impersonate businesses. The financial consequences often surface long after the technical flaw is fixed.

PayPal’s response

After discovery, PayPal closed the access path and corrected the faulty code. The company also reset passwords and reversed suspicious transactions.

Affected customers received two years of credit monitoring. PayPal advised them to watch for phishing attempts and unexpected financial activity.

These steps reduce immediate harm but cannot eliminate long-term identity risk.

What companies should learn

This event shows why perimeter security alone is insufficient. Organizations must verify how applications behave after every update.

Recommended practices include:

• Testing authorization logic after code changes
• Monitoring abnormal query patterns
• Limiting identity data exposure internally
• Treating minor anomalies as security alerts

Security must evaluate outcomes, not only access permissions.

Conclusion

The PayPal Working Capital breach did not involve malware or system takeover. A simple logic flaw exposed critical identity data for half a year.

Modern breaches increasingly come from functionality working incorrectly rather than systems failing completely. Companies that continuously audit application behavior will detect these problems earlier. Others will continue discovering incidents only after sensitive data has already circulated.