AccidentalFinancial ServicesTechnologyFinanceProgramming ErrorCustomer Data InvolvedIdentity (basic)Government IDMediumContained

PAYPAL, INC.

bd_8c8cf8fbf56b85ec · schema v1 · pii pii-v1

Severity

Medium

Discovered

Dec 12, 2025

Filed

Feb 19, 2026

To disclose

10 weeks

Affected

Not disclosed

Linked

2 filings

Confidence

64%

Full breach record for PAYPAL, INC. →3 incidents on file

PayPal disclosed that an error in its PayPal Working Capital loan application exposed PII (name, email, phone, business address, SSN, DOB) of a small number of customers between July 1, 2025, and December 13, 2025. The incident was discovered on December 12, 2025. PayPal rolled back the code change, terminated unauthorized access, reset passwords, and offered two years of credit monitoring.

J jump to incidentP pin to compareR raw source

Massachusetts clock⏱ MA AG >30d10 weeks discovery → filing

Incident timeline

undetected · 164 days

discovery → filing · 10 weeks / 69 days

Jul 1, 2025

Begins

Dec 12, 2025

Discovered

Feb 19, 2026

Filed

vs. sector median

+1 wks slower

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Nebraska State AGbd_a8daa63b011c94552026-02-19Verified

Name: PAYPAL, INC.
norm: paypal

Name: PAYPAL, INC.
norm: paypal
Industry: Financial ServicesllmTechnologyllm

Discovered: Dec 12, 2025
Breach occurred: Jul 1, 2025 – Dec 13, 2025
Undetected for: 164 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 10, 2026
Affected individuals: Not disclosed
Data types: Identity (basic)Government ID
Data elements: Social Security numberDate of birth
Attack vector: Unknown

During the incident: Began an investigation
Terminated the unauthorized access to PayPal’s systems
Reset the passwords of the affected PayPal accounts
Implemented enhanced security controls that will require you to establish a new password the next time you log in to your account if you have not already done so
Issued refunds to customers who experienced unauthorized transactions
Changes made: Rolled back the code change responsible for this error
Offering two years of complimentary credit monitoring and identity restoration services through Equifax
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(69 days from discovery to filing)
Compliance flags: MA AG >30d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Nebraska State AGFeb 19 · first

Massachusetts State AGFeb 19 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.mass.gov/doc/2026-240-paypal-inc/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 19, 2026
Raw hash: c3dae61a4f1619d2c73388b0572e64c84793ebbabfd1640cb1ef3c59af7474cd

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityPAYPAL, INC.

Victim entityPAYPAL, INC.

Incidentdiscovered Dec 12, 2025

Stated responseBegan an investigation

ComplianceMA AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.mass.gov