Six-Month SSN Leak? PayPal Loan App Flaw Left User Data Exposed

PayPal is facing fresh heat after a flaw in one of its loan tools left user data at risk for close to six months. According to BleepingComputer, the bug was found in the PayPal Working Capital (PPWC) loan app, a tool built to help small firms get quick cash. The flaw left user data exposed from July 1 to Dec 13, 2025. PayPal says it found the issue on Dec 12 and moved fast to fix it. The code change that led to the flaw was rolled back, and the path used by the malicious actor was shut down the next day.

In a notification to users, the company said "On December 12, 2025, PayPal identified that due to an error in its PayPal Working Capital ("PPWC") loan application, the PII of a small number of customers was exposed to unauthorized individuals during the timeframe of July 1, 2025 to December 13, 2025,"

"PayPal has since rolled back the code change responsible for this error, which potentially exposed the PII. We have not delayed this notification as a result of any law enforcement investigation."

This was not a minor slip. The exposed data may have had full names, email, phone, work address, date of birth, and even Social Secu rity num bers. That kind of data can be used for fraud or ID theft.

PayPal says only a small group of users were hit, though it has not shared a full count. Some of those users saw fraud on their accounts. The firm says it has paid back funds that were taken with no OK.

All hit users had their pass words reset. If they have not set a new one yet, they will be asked to do so at next sign in. PayPal also told users to watch bank and card logs with care.

This is not the first time PayPal has faced such a storm. In early 2023, the firm said that 35,000 accounts were hacked. Two years later, New York fined the firm $2 million over that same slip. Now, with yet one more data leak, some users may ask if the firm is doing enough to guard key data.