PayPal accounts breached in large-scale credential stuffing attack

guest · Jan 19, 2023

By Bill Toulas @billtoulas - January 19, 2023

PayPal is sending out data breach notifications to thousands of users who had their accounts accessed through credential stuffing attacks that exposed some personal data.
Click to expand...

Credential stuffing are attacks where hackers attempt to access an account by trying out username and password pairs sourced from data leaks on various websites.

This type of attack relies on an automated approach with bots running lists of credentials to "stuff" into login portals for various services.
Credential stuffing targets users that employ the same password for multiple online accounts, which is known as "password recycling."
Click to expand...

Close to 35,000 users impacted
PayPal explains that the credential stuffing attack occurred between December 6 and December 8, 2022. The company detected and mitigated it at the time but also started an internal investigation to find out how the hackers obtained access to the accounts.

By December 20, 2022, PayPal concluded its investigation, confirming that unauthorized third parties logged into the accounts with valid credentials.
Click to expand...

Also, the notification claims that the attackers have not attempted or did not manage to perform any transactions from the breached PayPal accounts.

"We have no information suggesting that any of your personal information was misused as a result of this incident, or that there are any unauthorized transactions on your account," reads PayPal's notification to impacted users.
"We reset the passwords of the affected PayPal accounts and implemented enhanced security controls that will require you to establish a new password the next time you log in to your account" - PayPal
Click to expand...

xxJackxx · Jan 19, 2023

One has to wonder if this came from the Norton Password Manager incident.

plat · Jan 19, 2023

Thanks mood. Here is my PayPal password update.

In the "process" now. I haven't been contacted by PayPal (yet) but this speaks a little louder.

Edit: fortunately my email is still viable. So glad I have MFA enabled for that.

Log in or Sign up

PayPal accounts breached in large-scale credential stuffing attack

guest Guest

xxJackxx Registered Member

plat Registered Member

Log in or Sign up

PayPal accounts breached in large-scale credential stuffing attack

guest Guest

xxJackxx Registered Member

plat Registered Member

Useful Searches