PayPal account credential stuffing exposing tax data
Between December 6 and December 8, 2022, attackers logged into 34,942 PayPal accounts using username and password pairs reused from other breaches, exposing names, addresses, dates of birth and Social Security or tax ID numbers. PayPal notified affected users on January 18, 2023. New York DFS later found that a data flow change had made full Social Security numbers visible and that PayPal had not required MFA.
- Victim
- PayPal
- Industry
- Financial services
- Country
- United States
- Intrusion began
- Dec 6, 2022
- First disclosed
- Jan 18, 2023
- Actor
- Financially motivated
- Initial access
- Credential stuffing
- Identity control that failed
- Authentication
- MFA
- Not enforced on the abused account
- Abused identity
- Human account
- Records affected
- 34,942 (Account holders notified, per PayPal's filing with the Maine attorney general.)
- Disclosed cost
- $2 million (Civil penalty paid to the New York Department of Financial Services (consent order, January 23, 2025).)
The identity lesson
Customer accounts that expose tax identifiers need MFA and credential stuffing defenses by default; DFS named both as missing controls.
Regulatory and legal outcome
New York DFS consent order and $2 million penalty, January 23, 2025, finding PayPal failed to require MFA or use controls such as CAPTCHA and rate limiting, after attackers used compromised credentials to reach unmasked Social Security numbers on 1099-K forms.
Go deeper on SWI
- Technique: Credential stuffing
Sources
- Superintendent Harris announces $2 million penalty against PayPal for cybersecurity failures, New York State Department of Financial Services, Jan 23, 2025
- PayPal warns 35,000 users of credential stuffing attacks, SecurityWeek, Jan 19, 2023
- PayPal says crooks accessed 34,942 customers' info, The Register, Jan 19, 2023
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- Chick-fil-A One loyalty accounts taken over by credential stuffing 2026 · Credential stuffing
- FortiBleed campaign harvests credentials through FortiGate devices 2026 · Credential stuffing
- Roku account credential stuffing in two waves 2024 · Credential stuffing
- 23andMe credential stuffing and DNA Relatives data scraping 2023 · Credential stuffing
Cite this record
SWI Community Team. (2026). PayPal account credential stuffing exposing tax data. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2023-paypal-credential-stuffing/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.