MisuseFinancial ServicesTechnologyFinancePrivilege AbuseBECEmployee Data InvolvedCustomer Data InvolvedMulti-Stage ChainIdentity (basic)Financial accountLowActive

PAYPAL, INC.

bd_1fc16b99b7a3b53e · schema v1 · pii pii-v1

Severity

Low

Discovered

Aug 8, 2019

Filed

Sep 9, 2019

To disclose

5 weeks

Affected · nationwide

671 in this filing

Confidence

66%

Full breach record for PAYPAL, INC. →3 incidents on file

PayPal Inc. notified the NH Attorney General of a vendor-insider fraud scheme impacting 67 Venmo accounts. Vendor employees misused customer data to facilitate unauthorized access and transactions. Discovered Aug 8, 2019. Notifications sent Sept 6, 2019. Affected data included names, emails, phone numbers, and partial financial account details. 1 NH resident affected.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 5 weeks / 32 days

Aug 8, 2019

Discovered

Sep 9, 2019

Filed

vs. sector median

5 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed67 affectedView incident

Name: PAYPAL HOLDINGS, INC.
norm: paypal holdings

Name: PAYPAL, INC.
norm: paypal
Also named: PayPal Holdings, Inc.operating subsidiary ofholding company
Industry: Financial ServicesllmTechnologyllm

Discovered: Aug 8, 2019
Materiality determined: —
Notification sent: Sep 6, 2019
Affected individuals: 67state + nationwide
Data types: Identity (basic)Financial account
Attack vector: Insider
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: InternalFinancial
Regulator citations: reported the matter to law enforcement
Initial access: insider_action

During the incident: Reported the matter to law enforcement
Accounts were locked
Customers were notified of the unauthorized activity
Customers were fully reimbursed for any unauthorized transactions
Offering to cover the cost of one year of credit monitoring for impacted customers
Changes made: Enhanced the monitoring of your Venmo account for potential fraud
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(32 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/paypal-20190909.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 9, 2019
Raw hash: 0f6049aa1c34d4310fe4e8e223abf6daddcab16ee1f9a12d92008936d45308d8

Reporting entityPAYPAL HOLDINGS, INC.

Victim entityPAYPAL, INC.

Incidentdiscovered Aug 8, 2019

Stated responseReported the matter to law enforcement

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov