Paypal Data Breach: Over 35000 000 Users’ Accounts Are Compromised

PayPal recently began sending notifications to users affected by data breaches. Credential stuffing attacks led to the data breach that allowed to users’ accounts.

Some personal information may have been compromised as a result. Users should take all necessary precautions to safeguard their data and keep an eye on suspicious activity to ensure that they are not exposed.

This is a form of cyber-attack in which hackers attempt to gain unauthorised access to accounts using username and password combinations that were obtained through data leaks from various websites.

Automating the task of trying various login credentials for a website or service allows you to do this automatically. As more information online is shared, these attacks become increasingly frequent.

Credential-stuffing threats are used by actors to target individuals who use the same password for several online accounts. It is also known as “password recycle” because hackers can gain easy access to different user accounts.

This is especially dangerous as hackers can gain access to accounts and use the information to attempt to access other accounts.

Data Breach

The credential stuffing attack took place between the 6th December and the 8th of Dezember 2022. The company detected the issue and took steps to mitigate it. However, the company also began investigating how hackers gained access to accounts to take control.

threat agents had used valid credentials in order to access its accounts after it concluded its investigation on December 20, 2022.

According to some claims, PayPal didn’t suffer a breach of its system and no evidence has been discovered that would prove attackers gained user credentials from PayPal directly.

35,000 Users Activated

According to PayPal, 34.942 customers suffered from this data breach according to its official report. According to reports, hackers had access to the following information during these two days.

• Names in full
• Birth dates
• Addresses postale
• Numbers for social security
• Individual tax identification numbers
• Transaction histories
• Credit with a connection
• Connected debit card details
• Invoicing information for PayPal

PayPal reacted quickly to the December 20-22 data breach and took measures to protect customers’ information.

The company immediately identified which accounts had been compromised and then took the necessary steps to change the passwords.

The affected accounts were closed to unauthorized parties, and they could not be accessed by them again.

Recommendations

PayPal managed to mitigate the damages caused by the breach, and also protect its customers against further damage through timely actions. To prevent future incidents like this, PayPal continues to improve its security procedures.

Below are the recommended security measures by the company.

• You should immediately change your passwords if you use the same password and username combination to access other accounts than PayPal.
• If you notice unusual activity, change your password immediately and inform the company.
• To add extra security to your PayPal account, enable 2-step verification in the Account Settings.
• Do not click on URLs that come from untrusted sources.
• Unknown sources may have sent you email attachments. Do not open them.
• PayPal will never request this information if you get an email from them or send you a text message asking for your password, login information, or any other authentication information such as a unique code.
• If you have any doubts or want to confirm their authenticity, please visit PayPal.com.
• It is important to consider messages that encourage urgency and immediate action.

Network Security Checklist