PayPal to pay $2 million settlement over 2022 data breach

New York State has announced a $2,000,000 settlement with PayPal over charges it failed to comply with the state's cybersecurity regulations, leading to a 2022 data breach. The Department of Financial Services (DFS) action says that threat actors took advantage of security gaps in PayPal's systems to conduct credential stuffing attacks that provided access to sensitive customer information. In 2023, PayPal disclosed that threat actors conducted a large-scale credentials stuffing attack between December 6th and December 8th, 2022, where 35,000 accounts were breached. The data exposed at the time included full names, dates of birth, postal addresses, social security numbers, and individual tax identification numbers. New York's DFS announcement sheds more light on the breach, explaining that one of PayPal's security lapses was an error in how Form 1099-K tax forms were distributed on the platform. "Customer data was exposed after PayPal implemented changes to existing data flows to make IRS Form 1099-Ks available to more of its customers," explains DFS. "However, the teams tasked with implementing these changes were not trained on PayPal's systems and application development processes. As a result, they failed to follow proper procedures before the changes went live." Following the faulty implementation, cybercriminals holding valid credentials for PayPal accounts were able to access those accounts and their 1099-K forms, which revealed a lot of sensitive information. The succ...