PayPal Working Capital Loan App Coding Error Exposed Customer PII

PayPal disclosed that a coding error in its PayPal Working Capital (PPWC) loan application exposed a small number of customers’ personally identifiable information (PII) to unauthorized parties for roughly six months (July 1 to December 13, 2025). The exposed data included business contact details (name, email, phone number, business address) and highly sensitive identifiers such as Social Security numbers and dates of birth; PayPal said its core systems were not compromised and that the issue stemmed from an internal software defect that was later rolled back.

PayPal detected the exposure on December 12, 2025, initiated an investigation, blocked the unauthorized access, and required password resets/new credentials for impacted accounts. A small number of affected customers reported unauthorized transactions, which PayPal said were refunded; reporting indicates approximately 100 customers were notified. PayPal also stated the notification was not delayed by law enforcement and is offering impacted individuals two years of credit monitoring/identity restoration services (via Equifax, per reporting) alongside strengthened security checks.