how it happened
- whoattackerspasswords leaked elsewhere
- the gapreused passwordsvalid logins
- the result34,942 accountsSSNs and tax IDs inside
what everyone assumed
A login system answers one question well: does this credential match. When the answer is yes, the session is granted, and that is the entire premise that lets a password mean anything. The credentials were genuine. They had simply been reused by their owners on some other site that had already been breached, and an attacker tried them here at scale.
what happened
This was credential stuffing: passwords leaked elsewhere, replayed against PayPal in bulk, betting that people reuse them. The attacker did not break into PayPal’s systems, and PayPal later found no evidence that they had. The matching worked exactly as designed. Each accepted login looked legitimate because, measured against the password alone, it was. The only thing separating these sessions from the real account holders was a fact the login check never asks about: who is actually at the keyboard.
step by step
- passwords leaked elsewhere are replayed in bulkBetting on reuse.
- 6-8 December 202234,942 accounts accept the right passwordEach login looks legitimate.the assumption breaks here
- identity data inside is exposedNames, birth dates, addresses, Social Security and tax numbers.
- no PayPal system was breachedThe right passwords belonged to the wrong people.
how it surfaced
PayPal concluded its investigation and notified 34,942 customers that their accounts had been accessed between December 6 and December 8, 2022. Inside those accounts sat full names, dates of birth, postal addresses, Social Security numbers, and tax identification numbers. No PayPal system had been compromised. The right passwords had simply belonged to the wrong people for three days.
A correct password proves a credential matches, not that the right person is using it.
When the credential can be reused from somewhere you do not control, the match alone stops being proof of anything.
picture it at a company like yours
The company here is made up. The other two paths are not: they happened, and each links to the story.
- in this storythe day it mattersAttackers try leaked passwords in bulk and thousands of logins succeed.what it costs youCustomer details are exposed, and you are the company that has to explain it.
- or it goes like thisit happened23andMe, 2023howLeaked passwords are tried against customer accounts until some open.what leavespersonal details of customers and their contactswho ends up with itfraudsters
- or it goes like thisit happenedThe Snowflake wave, 2024howAn old password opens a data store that never required a second step.what leavesthe whole database in one downloadwho ends up with itan extortion group
sources
your turn
what you can do about it
this week
Look at whether you would notice the pattern these attacks make: many accounts, many source addresses, a burst of correct-on-the-first-try logins.
Right now every successful login to your systems is being treated as a friend, because the password was right, and a credential-stuffing run looks identical from inside that assumption. The defense is the second factor that a leaked password cannot supply, and the monitoring that treats a wave of valid logins as a question worth asking.
go deeper
if you're not sure where to start
Run the offboarding checklist on one leaver. It covers every account and token to close when someone leaves.
open the checklist →