Almost 35,000 PayPal Accounts Hacked using Credential-stuffing

PayPal is sending out data breach notifications to thousands of users. Almost 35,000 PayPal Accounts were Hacked using Credential-stuffing. The hackers attempt to access an account by trying out the username and password pairs sourced from data leaks on various websites. This type of attack relies on an automated approach with bots running lists of credentials to “stuff” into login portals for various services.

Almost 35,000 PayPal Accounts Hacked using Credential-stuffing

According to Bleeping Computer, 34,942 PayPal users have been affected by this latest credential-stuffing attack on its systems. PayPal found this attack took place in early December 2022. After investigation, it revealed the likelihood of credential stuffing being used.

Check Also: MailChimp Discloses New Breach After Employees Got Hacked

For the two days the attack was running, hackers had access to all sorts of personal information, including full names, birth dates, addresses, social security numbers, and tax identification. They could also see PayPal transaction details that include credit card and bank information.

Surprisingly, attackers have not done any transactions yet. PayPal has also confirmed that no transactions have yet been made during this attack. It’s uncertain if this was the efforts of someone simply seeing if they could or if we should expect more scandalous actions to follow.

PayPal has changed passwords and notified impacted users. The company will also provide two years’ worth of pro bono Equifax identity monitoring to keep an eye on things. The company recommends everyone enable two-factor authentication to help protect against these attacks in future. It is best to change your password immediately. We also advise you not to use the same passwords on all your accounts.

See Also: PriceOye Pakistan Acquires Early Investment From Co-founder PayPal