PayPal has begun sending out notification letters to individuals impacted by a security incident that occurred in early December 2022. On December 20, 2022, PayPal confirmed that unauthorized third-party actors had access to customer accounts using login credentials between December 6 and December 8. The actors obtained access through credential stuffing attacks, in which previously compromised usernames and password pairs are used by actors to attempt to access various accounts. This type of attack is significant to users who use the same password for multiple accounts and do not change their passwords upon being notified of a breach. The actors were able to view and potentially exfiltrate personal information from certain users, which could contain users’ names, addresses, Social Security numbers (SSNs), individual tax identification numbers, and/or dates of birth. PayPal emphasized that there is no evidence that any personal information accessed has been misused and there is no evidence that login credentials were obtained from a PayPal system, meaning that their platform was not breached. Approximately 35,000 users have been impacted by this incident and the compromised accounts’ passwords have been reset by PayPal. CTIX analysts will continue to monitor for advancements regarding this incident.