What simply occurred? PayPal notified hundreds of customers that their accounts have been compromised final month after hackers used a credential stuffing assault. It is estimated that the non-public data of practically 35,000 individuals was leaked within the incident.
PayPal mentioned the accounts have been accessed by unauthorized events who have been in a position to guess person credentials, probably profiting from massive quantities of knowledge leaked from different websites. It highlights the hazard posed by individuals reusing their login username/password combos throughout a number of web sites. Password recycling remains to be frequent and may be prevented by utilizing a superb password supervisor.
This kind of assault will get its title from bots that run lists of credentials right into a website, filling login portals till they acquire entry. PayPal mentioned the assault occurred between December 6 and December 8, 2022, and affected 34,942 prospects. The firm emphasised that the incident was not on account of a breach of its personal methods, and there’s no proof that person credentials have been stolen from any PayPal methods.
The data accessed included the shopper’s title, handle, social safety quantity, private tax ID quantity and date of start. PayPal mentioned it has no data to counsel the info was misused. Notably, there was no proof of unauthorized fee transactions from the stolen accounts.
PayPal mentioned it launched an investigation as quickly because it turned conscious of unauthorized entry. It additionally takes steps to forestall additional buyer data (presumably fee and account particulars) from being stolen. The firm reset passwords for affected accounts and “applied enhanced safety controls.”
These incidents usually contain the sufferer firm notifying regulation enforcement, however The Reg experiences that PayPal didn’t contain the police. The publication requested PayPal why, however it by no means answered.
PayPal says it would provide prospects two years of id monitoring from Equifax, an organization no stranger to knowledge breaches (and has despatched false credit score scores previously). The funds large additionally suggested affected customers to activate two-factor authentication (2FA) safety on their accounts and alter any recycled PayPal credentials used on different websites or companies.
