The PayPal Breach – Who Was Affected and How You Can Protect Yourself | McAfee Blog

PayPal recently notified thousands of its customers that their accounts were breached by hackers, leaving their Social Security Numbers and other key pieces of personal information exposed as a result. 

Sources report, that the attack involved “credential stuffing,” where hackers gather lists of usernames and passwords sourced from the dark web or from data breaches—and then “stuff” those credentials into login systems, giving them access to those accounts. 

This form of attack is particularly dangerous for people who re-use passwords across their accounts, as hackers can steal a password from one account and use it to access others. 

It is reported that PayPal notified users affected by this attack on January 18th with an email since made available online. The email states that,  

“Based on PayPal’s investigation to date, we believe that this unauthorized activity occurred between December 6, 2022, and December 8, 2022, when we eliminated access for unauthorized third parties. During this time, the unauthorized third parties were able to view, and potentially acquire, some personal information for certain PayPal users.” 

PayPal further detailed the information exposed (emphasis ours): 

The personal information that was exposed could have included your name, address, Social Security number, individual tax identification number, and/or date of birth. 

The email went on to say that PayPal reset the passwords of the affected accounts and will require affected users to establish a new password the next time they log in to their accounts. 

What to know about the PayPal attack and other attacks like it. 

It takes time for companies to discover breaches and other illegal activities on their networks. The activity may have occurred days, weeks, or even months before it was discovered. Thereafter, it takes yet more time for companies to investigate the attack, determine the method of entry, what was affected, and to what extent—not to mention update their security measures as needed. 

In the case of PayPal, the company stated that the attacks occurred between December 6th and 8th of 2022, and the notification sent to affected customers was dated January 18th.  

This is typical of such attacks. Time passes before victims get notified. And yet more victims may be identified as investigations continue, leaving hackers with a relatively large window of opportunity to do harm. 

What should I do if I think my account was caught up in the PayPal attack? 

Given the nature of the PayPal attack, there are a few steps you can take to protect yourself in its aftermath, which involves a combination of preventative steps and some monitoring on your part. 

Change your passwords and use a password manager 

Given that passwords were involved, changing your PayPal password is a must. (As stated, PayPal will require you to do so.) And if you re-use passwords or similar passwords across accounts, changing them is a must as well.  

Strong and unique passwords are best, which means never reusing your passwords across different sites and platforms. Using a password manager will help you keep on top of it all, while also storing your passwords securely. Moreover, changing your passwords regularly may make a stolen password worthless because it’s out of date by the time a hacker attempts to use it. 

Enable two-factor authentication 

While a strong and unique password is a good first line of defense, enabling two-factor authentication across your accounts will help your cause by providing an added layer of security. It’s increasingly common to see nowadays, where banks and all manner of online services will only allow access to your accounts after you’ve provided a one-time passcode sent to your email or smartphone.  

PayPal offers two-factor authentication as an option, and you can enable it by logging into your account settings and then clicking on the “Security” tab. 

Report unauthorized use of your PayPal account immediately 

Per PayPal’s customer email, contact their customer service for assistance if you spot any unusual activity on your account. 

Monitor your accounts and credit for usual activity 

If you spot unusual or unfamiliar transactions on your bank or credit card statements, follow up immediately. That could indicate improper use. In general, banks, credit card companies, and many businesses have countermeasures to deal with fraud, along with customer support teams that can help you file a claim if needed. 

Given number the accounts you might have, a credit monitoring service can help. McAfee’s credit monitoring service can help you keep an eye on changes to your credit score, report, and accounts with timely notifications and provide guidance so you can take action to tackle identity theft. 

Keep an eye out for phishing attacks 

With some personal information in hand, bad actors may seek out more. They may follow up a high-profile attack with rounds of phishing attacks that direct you to bogus sites designed to steal your personal information—either by tricking you into providing it or by stealing it without your knowledge. So as it’s always wise to keep a skeptical eye open for unsolicited messages that ask you for information in some form or other, often in ways that urge or pressure you into acting.  

If you are contacted by PayPal, make certain the communication is legitimate. Bad actors may pose as PayPal to steal personal information. Do not click on links sent in emails, texts, or messages. Instead, go straight to the PayPal website or contact them by phone directly. 

Consider using identity monitoring 

An identity monitoring service can monitor everything from email addresses to IDs and phone numbers for signs of breaches so you can take action to secure your accounts before they’re used for identity theft.​ Personal information harvested from data breaches can end up on dark web marketplaces where it’s bought by other bad actors so they can launch their own attacks. McAfee’s monitors the dark web for your personal info and provides early alerts if your data is found on there, an average of 10 months ahead of similar services.​ We also provide guidance to help you act if your information is found. 

Check your credit and consider a credit freeze 

When personal information gets released, there’s a chance that a hacker, scammer, or thief will put it to use. This may include committing fraud, where they draw funds from existing accounts, and theft, where they create new accounts in a victim’s name. 

Another step that customers can take is to place a credit freeze on their credit reports with the major credit agencies. This will help prevent bad actors from opening new lines of credit or take out loans in a victim’s name by “freezing” their credit report so that potential creditors cannot pull it for reference.  

McAfee+ plans give you guidance on how to place a full security freeze, stopping lenders and other companies from seeing your credit file. This halts the application process for loans, credit cards, utilities, new bank accounts, and more. A security freeze won’t affect your credit score. ​ 

Get comprehensive online protection and identity theft coverage 

A complete suite of online protection software can offer layers of extra security. In addition to more private and secure time online with a VPN, identity monitoring, and password management, it includes web browser protection that can block malicious and suspicious links that could lead you down the road to malware or a phishing scam—which antivirus protection can’t do alone.  

Additionally, we offer $1 million in identity theft coverage and restoration support from a licensed recovery pro who can help you repair your identity and credit if you find yourself a victim. 

What about my Social Security Number? 

Your Social Security or tax ID number is one of the most precious pieces of personal information you have. With them, an identity thief can open new accounts or lines of credit in your name, not to mention gain employment, claim insurance benefits, or even commit crimes in your name.  

PayPal stated that victims may have had Social Security or tax ID number exposed. If you believe this occurred to you, file a report with the Federal Trade Commission (FTC), which handles such cases. From there, they will provide you with a set of next steps. 

The PayPal attack – you have ways to protect yourself 

Not all data breaches make the news. Businesses and organizations, large and small, have all fallen victim to them, and with regularity. The measures you can take here are measures you can take even if you don’t believe you were caught up in the PayPal breach.  

Data breaches typically make the news when it affects a large company and generally only after they discover and release word of it. This means you might not hear about a breach until weeks or even months after your stolen info has been in circulation on the dark web. The measures you can take here can mitigate the damage of such attacks, even if you don’t think you were caught up in a specific breach.  

However, you have every reason to act now rather than wait for additional news. Staying on top of our credit and identity has always been important, but given all the devices, apps, and accounts we keep these days leaves us more exposed than ever, making protecting ourselves a must.