A cybercriminal claims to be selling a database containing 15.8 million PayPal credentials with plain-text passwords on the dark web. This alleged PayPal data breach raises important questions about where the information really comes from and highlights the growing role of infostealers in the cybercriminal ecosystem.
Details of the alleged PayPal data breach
A user nicknamed “Chucky_BF” is selling what they call the “Global PayPal Credential Dump 2025” on a cybercrime forum. This PayPal data breach allegedly contains 15.8 million email-password pairs stored in plain text, along with PayPal-specific URLs including endpoints such as /signin, /signup and /connect.
The dataset is said to be 1.1 GB and includes email addresses from major providers such as Gmail, Yahoo and Hotmail, as well as country-specific domains. The cybercriminal claims the data dates from 6 May 2025 and presents it as ideal for phishing campaigns and credential stuffing attacks.
PayPal disputes the data breach
PayPal has firmly denied any recent breach of its systems. The company told several specialist media outlets that no PayPal data breach took place and that the allegations relate to a 2022 security incident, not a new breach. PayPal’s position raises questions about the authenticity and freshness of the data allegedly for sale.
PayPal’s quick reaction suggests the company is taking the allegations seriously, even as it disputes their validity. The company stressed that it never stores passwords in plain text, which calls into question the stated origin of the data.
The infostealer hypothesis
Cybersecurity experts, including Troy Hunt of Have I Been Pwned, believe this alleged PayPal data breach more likely comes from infostealers than from a direct breach of PayPal’s systems. Infostealers are malware that silently harvest saved passwords and other sensitive information from infected devices.
Several elements support this hypothesis: the disorganised nature of the data, the presence of plain-text passwords that PayPal never stores in that form, and the relatively low asking price ($750). Infostealers such as RedLine, Raccoon and Vidar are widespread and now affect Windows, macOS and Android.
Impact and risks for users
Even if this data does not come directly from PayPal, it poses real risks for users. Cybercriminals can use the information for credential stuffing attacks, testing these credentials on PayPal and other services in the hope that users reuse their passwords.
The structured data also makes it easier to automate attacks, with an email:password:URL format that malicious tools can use directly. Validated email addresses can be used to build particularly convincing phishing campaigns aimed specifically at PayPal users.
Context and PayPal’s security history
This alleged PayPal data breach comes at a delicate time for the company. In January 2025, PayPal agreed to pay a $2 million fine to US regulators for failing to comply with New York’s cybersecurity regulation, following a 2022 incident that exposed 35,000 accounts.
This recent history makes the new allegations particularly sensitive and partly explains PayPal’s firm response. The company is currently working on a new single-step authentication system to replace traditional two-factor authentication.
Recommendations for PayPal users
In light of this alleged PayPal data breach, users should take preventive measures. It is essential to change your PayPal password immediately if you reuse it elsewhere, and to enable multi-factor authentication if you haven’t already.
Users should also regularly monitor the activity of their PayPal account and linked bank accounts. Stay alert to phishing attempts that could exploit this alleged breach, and always check that communications are genuine through PayPal’s official channels.
Conclusion
This alleged PayPal data breach perfectly illustrates modern cybersecurity challenges. Even without a direct breach of the company’s systems, users remain exposed to the risks of infostealers and password reuse. The situation underlines the crucial importance of digital hygiene and of adopting stronger authentication solutions such as passkeys.
Frequently asked questions
It is an alleged leak exposing 15.8 million PayPal credentials sold on the dark web, which PayPal formally disputes, saying no breach took place.
PayPal categorically denies any recent breach of its systems and attributes the allegations to a 2022 incident, not a new data breach.
Experts believe the data comes from infostealers, malware that steals passwords saved on infected devices, rather than from a direct breach of PayPal.
Change your PayPal password immediately, enable multi-factor authentication, monitor your account and be wary of phishing attempts.
Use an up-to-date antivirus, avoid suspicious downloads, use unique passwords for each service and favour multi-factor authentication.
Leave a Reply