AccidentalFinancial ServicesFinanceMisconfigurationCustomer Data InvolvedPIIIdentity (basic)Government IDFinancial accountMediumContained

PAYPAL, INC.

bd_a8daa63b011c9455 · schema v1 · pii pii-v2

Severity

Medium

Discovered

Dec 12, 2025

Filed

Feb 19, 2026

To disclose

—

Affected

Not disclosed

Linked

2 filings

Confidence

65%

Full breach record for PAYPAL, INC. →3 incidents on file

PayPal Inc notified Nebraska residents of a data breach involving a PayPal Working Capital loan application error. Unauthorized access occurred between July 1, 2025, and December 13, 2025. Exposed data included names, contact info, SSNs, dates of birth, and financial account numbers. PayPal rolled back the code change, reset passwords, issued refunds for unauthorized transactions, and offered two years of credit monitoring via Equifax.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 164 days

Jul 1, 2025

Begins

Dec 12, 2025

Discovered

Feb 19, 2026

Filed

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_8c8cf8fbf56b85ec2026-02-19Candidate

Name: PAYPAL, INC.
norm: paypal

Name: PAYPAL, INC.
norm: paypal
Industry: Financial Servicesllm

Discovered: Dec 12, 2025
Breach occurred: Jul 1, 2025 – Dec 13, 2025
Undetected for: 164 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 19, 2026
Affected individuals: Not disclosed
Data types: PIIIdentity (basic)Government IDFinancial account
Attack vector: Misconfiguration
MITRE ATT&CK: T1535 Unauthorized Access to Cloud Environment
Threat actor: External

During the incident: Began an investigation
Terminated the unauthorized access to PayPal’s systems
Reset the passwords of the affected PayPal accounts
Implemented enhanced security controls that will require you to establish a new password the next time you log in to your account
Issued refunds to these customers
Offering you two years of complimentary credit monitoring and identity restoration services through Equifax
Changes made: Rolled back the code change responsible for this error
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Massachusetts State AGFeb 19 · first

Nebraska State AGFeb 19 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://nebraska.gov/ago/data-breach/documents/611b07f8-8191-417b-aadc-656904d7b1ca.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 19, 2026
Raw hash: d73b9d727e30dc478c7fa68fa381a694b46f6511621fb883ee06a2e511a3545e

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityPAYPAL, INC.

Victim entityPAYPAL, INC.

Incidentdiscovered Dec 12, 2025

Stated responseBegan an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancenebraska.gov