HackingStolen CredentialsCustomer Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTMediumContained
PAYPAL, INC.
bd_523acb840ed66f31 · schema v1 · pii pii-v1
Full breach record for PAYPAL, INC. →PayPal confirmed unauthorized access to customer accounts using login credentials between Dec 6-8, 2022. The incident was discovered on Dec 20, 2022. Affected data may include name, address, SSN, ITIN, and DOB. PayPal reset passwords, implemented enhanced security controls, and offered two years of Equifax identity monitoring. No evidence suggests credentials were obtained from PayPal systems.
California clockDiscovered Dec 20, 2022 → Notified Jan 18, 202329d ✓ CA 60-day OK29 days discovery → filing
This filing is one of 4 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (3) · sorted by filing gap
- bd_23c5745c2f338938Washington State AGfiled 2023-01-18Candidate
- bd_a2e5f3a545f48379Oregon State AGfiled 2023-01-18Verified
- bd_add16c56f5a6da9dMaine State AGfiled 2023-01-18Verified
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-561929
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jan 18, 2023
- Raw hash
- 4a53205adc0dc0733ab09c3778bda79990af1f88adffe40a0de75669a2408f13
Reporting entity
- Name
- PAYPAL, INC.norm: paypal
Victim entity
- Name
- PAYPAL, INC.norm: paypal
Incident
- Discovered
- Dec 20, 2022
- Materiality determined
- —
- Notification sent
- Jan 18, 2023
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid Accounts
- Threat actor
- External
- Initial access
- valid_credentials
Compliance
- Time to disclose
- 29 days(29 days from discovery to filing)
- Compliance flags
- CA 60-day OK · 29d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Dec 20, 2022→ Notified: Jan 18, 202329d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.