PayPal has disclosed a data breach stemming from a coding error in its PayPal Working Capital (PPWC) loan application, which inadvertently exposed personally identifiable information—including names, email addresses, phone numbers, business addresses, Social Security numbers, and dates of birth—of an undisclosed number of customers from July 1, 2025, to December 13, 2025. The issue was discovered on December 12, 2025, and the company rolled back the faulty code the following day while notifying affected users in letters dated February 10, 2026.

PayPal is offering two years of complimentary credit monitoring through Equifax to impacted individuals, amid heightened risks of identity theft and fraud, though only a small number of customers experienced unauthorized transactions, which were refunded.