New York State Fines PayPal $2 Million Over 2022 Data Breach

The Department of Financial Services (DFS) for the state of New York (US) announced that it will fine PayPal $2 million USD over a 2022 data breach that exposed the personally identifiable information (PII) of tens of thousands of customers, following a years-long investigation.

The original breach occurred in December 2022, when PayPal implemented site-wide changes to make a tax form accessible to a broader base. According to a consent order, between December 6 and December 8, 2022, a PayPal security analyst then discovered an online message that read “PP EXPLOIT TO GET SSN,” and included instructions to view PayPal customers’ social security numbers (SSNs).

The breach was a result of credential stuffing, an attack where bad actors input (or “stuff”) a large number of credentials taken elsewhere until one of them works. The success of these kinds of attacks depends on users using the same passwords across multiple devices or services, and on the lack of further authentication features by the services.

Hackers depend on third-party datasets containing leaked passwords for these kinds of attacks, such as the leak of nearly 10 billion passwords in 2024, which experts have called the “biggest password leak ever.”

Though PayPal took corrective actions almost immediately after the December 2022 attack, the PII of 34,942 accounts had already been compromised. Besides SSNs, the leaked information also included full names, dates of birth, and other account information.

New York’s DFS quickly launched an investigation into PayPal’s cybersecurity practices, eventually concluding that “PayPal failed to use qualified personnel to manage key cybersecurity functions and failed to provide adequate training to address cybersecurity risks. These failures led to sensitive customer information, including social security numbers (SSNs), being left unredacted and easily accessible to cybercriminals,” as written in a press release.

The company cooperated with the DFS probe. “Protecting consumers’ personal information and maintaining a secure platform is a top priority for us and we take our regulatory responsibilities seriously,” wrote PayPal in a statement.

PayPal now requires multi-factor authentication for all US account logins, according to the consent order.