by AngryData
4 subcomments
- Almost 20 years ago now paypal stole my $15 for no cause, I bought a videogame with it once off a major website, had $15 in it sitting around for 6 months, tried to use it to buy something off ebay and got locked out instantly. Then demanded all sorts of hoop jumping to get it back with notarized license and crap. Ive been saying screw them ever since, and not once have I regretted it. Every year there is some more shit showing that was the right move.
How many millions of dollars have they seized without cause? I can't believe they are still going, I can only hope someday somebody with a bit of money can sue their pants off in court and get them shut down.
by sunshinekitty
7 subcomments
- At one point on the internet PayPal was the most trusted way to send and receive money - at least you are limiting sharing your personal payment information with random companies on the internet who may or may not be compliant. Lately though, with companies like Stripe and Plaid making it nearly frictionless to add payments to your website just as PP once did, and things like Google & Apple pay - why is there a need to use PayPal anymore? Their support is notoriously awful, the product is slow and dated, as a consumer at least I see no reason to not stop using PayPal (and their subsidies) entirely.
- I've never used PayPal because someone signed up with my email to buy internet pornography before I could legally create an account at 18 years old. PayPal allows people to buy things without verifying the email, so now I'm stuck with it.
I could create a separate email, but I don't want to. I could take over the account, but I'm also unwilling to commit financial fraud. I called PayPal, and they said they couldn't do anything.
I've just used Stripe, Link, or directly used my credit card. Nothing bad has ever happened as a result. Any time I've had a dispute, I've been able to get a refund from my credit card company.
I also live in Canada. We have had "e-Transfer" since 2003, meaning I can securely email or text money to friends and family with no fees. So I don't need PayPal for that, either.
- So from the Article they claim:
"PayPal has since rolled back the code change responsible for this error, which potentially exposed the PII. We have not delayed this notification as a result of any law enforcement investigation."
That does little to explain the 2 month-ish delay in disclosing it. I presume they could have disclosed _at least_ that account data was leaked even if the underlying bug wasn’t yet closed?
Obviously without disclosing the nature of the bug in that case.
by elphinstone
1 subcomments
- I recently tried to sign up for paypal, "tried" being the operative word since their garbage, broken processes couldn't verify me despite bank info, etc.
After seeing their profound incompetence at customer acquisition, ineptitude on the security front is no surprise.
by TitaRusell
2 subcomments
- Hopefully WERO will finally wipe out PayPal in Europe. Despite the ridiculous name.
by jimnotgym
2 subcomments
- Great, who from PayPal is going to jail over this?
- > The company now offers affected users two years of free three-bureau credit monitoring and identity restoration services through Equifax, which require enrollment by June 30, 2026.
How tasteful.
by anonzzzies
2 subcomments
- Who still uses PayPal? I never hear it mentioned here anymore. They always were a scammy company, but especially very bad for sellers as they always side with the buyers. Locking up money for months of startups without cause etc. They terminated my seller account because 'fraud', no dispute possible. Years later they terminated my buyer account for 'fraud' no dispute possible. Never participated in anything that even looks like fraud but to their AI.
Wish them many bad press.
- I think the paypal response at the bottom needs to be lifted to the top. It's way more terrifying to see "data breach" and "exposed data" when you don't know how many are affected and whether unauthorized access was part of the story or not.
by thisislife2
0 subcomment
- I am still pissed at PayPal for stealing some money from me (this was probably a decade ago) - I opened a new PayPal account in India, and PayPal required me to add a Debit Card (Mastercard or Visa) to it. It also said that to verify the card, it would debit a dollar or two from it, and then refund it back. Bastards stole around Rs. 100 from me and never refunded it! (I was a broke student back then, so it hurt! :). In the midst of all that, India tightened its regulations on non-banking online transfers, and I don't remember exactly, but I think PayPal chose to partially exit the Indian market (because it couldn't compete and / or because it didn't want to abide by the regulations). Ebay also shut down in India around that time, if I remember right.
- These kind of breaches are why I'm against KYC's current implementation.
If the government wants to know who I am, that's fine, I'm not here to fight law. I however don't think it should be necessary to tell banks and private businesses where I physically sleep. That is more information than they need to operate, and every few months it seems someone has a data breach.
by lurkercodemnky
0 subcomment
- The ignorance of a company like PayPal is obviously bad.
That said, I think we need to have an equivalent of automated integration testing for security vulnerabilities.
Even if PenTesters (or whatever they're called these days) do some testing and uncover some bugs, the applications under continuous development will inevitably introduce "bugs" not seen before.
by himata4113
1 subcomments
- paypal is still around? I haven't seen any "accepts paypal" / paypal / checkout with paypal since around 2023 and the realization of it makes me unreasonably happy.
by kevincloudsec
0 subcomment
- love the update at the bottom. 'our systems were not compromised' doing a lot of heavy lifting for 'a code change exposed SSNs to unauthorized individuals for six months.
by anonymous908213
2 subcomments
- Irrelevant to the current breach, but at the end of the article...
> In January 2023, PayPal notified customers of another data breach after a large-scale credential stuffing attack compromised 35,000 accounts between December 6 and December 8, 2022.
> Two years later, in January 2025, New York State announced a $2,000,000 settlement with PayPal over charges that it failed to comply with the state's cybersecurity regulations, leading to the 2022 data breach.
I didn't hear about this New York case. I'm the first to lament the incredibly sorry state of affairs of data security, to the extent that such security exists at all, but it is insane that you can get fined $2,000,000 for your customers re-using e-mail + password combinations between sites and becoming compromised as a result. I truly loathe mandatory 2FA with every fiber of my being and I guess New York would like to enforce it on the world? Sigh. Everything about the internet just gets worse and worse, continuously.
- They still exist!? I just don't use any merchant that lacks the "checkout with apple pay" or "checkout with amazon" button. Too much trouble.
- Yet another reason I deleted my main paypal account years back. Don't trust them.
by josefritzishere
0 subcomment
- There should be legal penalties for failing to inform users in a timely fashion. A 6 month delay is ridiculous. They put all their users at risk.
by oxqbldpxo
1 subcomments
- Imagine when Palantir gets hacked.
- [flagged]
Hacker News