PayPal to pay $2 million settlement over 2022 data breach
ID: b7901db3-9bae-5401-9e45-c1cca997797c
STIX ID: report--b7901db3-9bae-5401-9e45-c1cca997797c
Feed Name: Bleeping Computer
Threat Score
New York DFS announced a $2,000,000 settlement with PayPal after a December 6–8, 2022 credential-stuffing campaign breached approximately 35,000 accounts and exposed sensitive customer PII (names, DOBs, addresses, SSNs and ITINs). DFS attributed the breach to flawed changes in 1099-K distribution, lack of mandatory MFA, weak access controls (no CAPTCHA/rate limiting), and inadequate personnel training; PayPal implemented mitigations including data masking, CAPTCHA and rate limiting, and mandatory MFA for U.S. accounts.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.