{"id":267,"date":"2023-03-06T09:53:54","date_gmt":"2023-03-06T15:53:54","guid":{"rendered":"https:\/\/kentprotect.com\/?p=267"},"modified":"2023-03-06T10:33:10","modified_gmt":"2023-03-06T16:33:10","slug":"2022-paypal-breach-affects-almost-35000-users-results-in-class-action-lawsuit","status":"publish","type":"post","link":"https:\/\/kentprotect.com\/index.php\/2023\/03\/06\/2022-paypal-breach-affects-almost-35000-users-results-in-class-action-lawsuit\/","title":{"rendered":"2022 PayPal breach affects almost 35,000 users, results in class-action lawsuit"},"content":{"rendered":"<div class='booster-block booster-read-block'><\/div>\n<p class=\"wp-block-paragraph\">(Image source: Doiy, 2018)<\/p>\n\n\n\n<p class=\"has-medium-font-size wp-block-paragraph\"><strong>One-sentence summary: <\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A mass credential stuffing attack against Paypal users in December 2022 results in an almost 35,000-user data breach and a class action lawsuit.<\/p>\n\n\n\n<p class=\"has-medium-font-size wp-block-paragraph\"><strong>Who was involved?<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Paypal, almost 35,000 Paypal users, and a threat actor. <\/p>\n\n\n\n<p class=\"has-medium-font-size wp-block-paragraph\"><strong>What was the timeline?<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">December 6, 2022: Breach starts<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">December 8, 2022: Breach ends, Paypal eliminates access of unauthorized third parties <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">December 20, 2022: Breach investigation concluded<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">January 18, 2023: Paypal notifies affected users via letters as well as state offices (e.g., Maine)<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">March 2, 2023: Class action lawsuit is filed against Paypal in the Northern District of California<\/p>\n\n\n\n<p class=\"has-medium-font-size wp-block-paragraph\"><strong>What occurred?<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In December 2022, a threat actor or group of threat actors performed a mass credential stuffing attack against Paypal allowing the successful breach of almost 35,000 user accounts (Gesser, 2023). The breach ended in only two days, however, the potential data breached included: &#8220;name, address, Social Security number, individual tax identification number, and\/or date of birth&#8221; (Paypal, 2023, p. 1). Paypal notified users the next month and now faces a class action lawsuit for the incident (Donkor, 2023, p. 2; <em>Pillard et al v. PayPal<\/em>, 2023). <\/p>\n\n\n\n<p class=\"has-medium-font-size wp-block-paragraph\"><strong>Estimated costs:<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Equifax Two-year identity and credit monitoring. &#8220;Outside counsel&#8221; (Donkor, 2023, p. 1). Breach notification. Litigation defense. <\/p>\n\n\n\n<p class=\"has-medium-font-size wp-block-paragraph\"><strong>Involved laws: <\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Federal Trade Commission Act, 15 U.S.C. \u00a7 45<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">State laws: Maine: 10 M.R.S.A. \u00a7 1346<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">California: CCPA and Cal. Civ. Code \u00a7 1798.29(a)<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Nebraska Consumer Protection Act, Neb. Rev. Stat. \u00a7 59-1601, et seq. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Nebraska Uniform Deceptive Trade Practices Act, Neb. Rev. Stat. \u00a7 87-301, et seq. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Texas Deceptive Trade Practices\u2014Consumer Protect Act, Tex. Bus. &amp; Com. Code \u00a7 17.46(b)<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Read more about the legal allegations in the lawsuit here: <\/em><a href=\"https:\/\/www.bloomberglaw.com\/ms\/public\/desktop\/document\/PillardetalvPayPalIncDocketNo523cv00936NDCalMar022023CourtDocket\/1\">Pillard et al v. PayPal, Inc., Docket No. 5:23-cv-00936 (N.D. Cal. Mar 02, 2023), Court Docket<\/a><\/p>\n\n\n\n<p class=\"has-medium-font-size wp-block-paragraph\"><strong>Root cause: <\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Credential stuffing enabled valid account access (Donkor, 2023, p. 1). Potential social engineering attacks or external breaches were used to obtain the credentials beforehand (external to Paypal) (Donkor, 2023, p. 1). <\/p>\n\n\n\n<p class=\"has-medium-font-size wp-block-paragraph\"><strong>Lessons learned: <\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Rate limiting, lockout policies, strong password policies, conditional access (e.g., geographical, IP, or CTI-based) policies, risk-based authentication, attribute-based access control (ABAC), mandatory 2FA, FIDO authentication, breach-checking\/breach warning password manager. <\/p>\n\n\n\n<p class=\"has-medium-font-size wp-block-paragraph\"><strong>Sources: <\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Doiy, J. (2018, September). <em>Louise-Pentland-Article-201809281401.jpg<\/em>. law.com. https:\/\/images.law.com\/contrib\/content\/uploads\/sites\/390\/2018\/09\/Louise-Pentland-Article-201809281401.jpg<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Donkor, A. (2023). BY ONLINE SUBMISSION. In <em>Office of the Maine Attorney General<\/em>. Office of the Maine Attorney General. Retrieved March 6, 2023, from https:\/\/apps.web.maine.gov\/online\/aeviewer\/ME\/40\/766753f1-f9c7-4dc5-9a5c-fe0f3ff51c06\/68d53bbc-4a55-41f8-ad20-2831191f37f7\/document.html<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Gesser, A. (2023, January 18). <em>Office of the Maine AG: Consumer Protection: Privacy, Identity Theft and Data Security Breaches<\/em>. Office of the Maine Attorney General. Retrieved March 6, 2023, from https:\/\/apps.web.maine.gov\/online\/aeviewer\/ME\/40\/766753f1-f9c7-4dc5-9a5c-fe0f3ff51c06.shtml<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Paypal. (2023). NOTICE OF SECURITY INCIDENT. In <em>Office of the Maine Attorney General<\/em>. Office of the Maine Attorney General. Retrieved March 6, 2023, from https:\/\/apps.web.maine.gov\/online\/aeviewer\/ME\/40\/766753f1-f9c7-4dc5-9a5c-fe0f3ff51c06\/60edd0dc-c00d-4117-b63d-e809fd21e918\/document.html<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Pillard et al v. PayPal, Inc., Docket No. 5:23-cv-00936 (N.D. Cal. Mar 02, 2023). https:\/\/www.bloomberglaw.com\/ms\/public\/desktop\/document\/PillardetalvPayPalIncDocketNo523cv00936NDCalMar022023CourtDocket\/1<\/p>\n\n\n\n<figure class=\"wp-block-embed is-type-video is-provider-youtube wp-block-embed-youtube wp-embed-aspect-4-3 wp-has-aspect-ratio\"><div class=\"wp-block-embed__wrapper\">\n<iframe loading=\"lazy\" title=\"2022 PayPal breach affects almost 35,000 users, results in class-action lawsuit\" width=\"640\" height=\"480\" src=\"https:\/\/www.youtube.com\/embed\/E_Do7O9x2bo?feature=oembed\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share\" referrerpolicy=\"strict-origin-when-cross-origin\" allowfullscreen><\/iframe>\n<\/div><figcaption class=\"wp-element-caption\">YouTube\/Blog Notification Post<\/figcaption><\/figure>\n","protected":false},"excerpt":{"rendered":"<p>(Image source: Doiy, 2018) One-sentence summary: A mass credential stuffing attack against Paypal users in December 2022 results<\/p>\n","protected":false},"author":4,"featured_media":269,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[257,68,3,12,85,13,265,76,63,262,261,75,61,11,10,77,74,256,255,254,14,201,69,71,241,72,70,8,27,263,182,264,240,246,252,253,67,136,260,62,259,15],"class_list":["post-267","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-the-breach-report","tag-account","tag-been-pwned","tag-breach-report","tag-breaches","tag-california","tag-ciso","tag-class-action","tag-cloud","tag-computer-security","tag-credential-stuffing","tag-credentialstuffing","tag-cyber-security","tag-cybercrime","tag-cybersecurity","tag-dallas","tag-dark-web","tag-data-breach","tag-digital-wallet","tag-digitalwallet","tag-ecommerce","tag-executive","tag-exfiltration","tag-have-been-pwned","tag-have-i-pwned","tag-haveibeenpwned","tag-i-been-pwned","tag-i-have-been-pwned","tag-kent-protect","tag-kentprotect","tag-lawsuit","tag-leak","tag-litigation","tag-online","tag-online-sales","tag-paypal","tag-purchasing","tag-pwned","tag-san-jose","tag-sanjose","tag-security","tag-shopping","tag-summary"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.4 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>2022 PayPal breach affects almost 35,000 users, results in class-action lawsuit - Kent Protect<\/title>\n<meta name=\"description\" content=\"A mass credential stuffing attack against Paypal users in December 2022 results in an almost 35,000-user data breach and a class action lawsuit.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/kentprotect.com\/index.php\/2023\/03\/06\/2022-paypal-breach-affects-almost-35000-users-results-in-class-action-lawsuit\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"2022 PayPal breach affects almost 35,000 users, results in class-action lawsuit - Kent Protect\" \/>\n<meta property=\"og:description\" content=\"A mass credential stuffing attack against Paypal users in December 2022 results in an almost 35,000-user data breach and a class action lawsuit.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/kentprotect.com\/index.php\/2023\/03\/06\/2022-paypal-breach-affects-almost-35000-users-results-in-class-action-lawsuit\/\" \/>\n<meta property=\"og:site_name\" content=\"Kent Protect\" \/>\n<meta property=\"article:published_time\" content=\"2023-03-06T15:53:54+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-03-06T16:33:10+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/kentprotect.com\/wp-content\/uploads\/2023\/03\/Louise-Pentland-Article-201809281401.webp\" \/>\n\t<meta property=\"og:image:width\" content=\"620\" \/>\n\t<meta property=\"og:image:height\" content=\"372\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/webp\" \/>\n<meta name=\"author\" content=\"Kyler Kent CISSP\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Kyler Kent CISSP\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/kentprotect.com\\\/index.php\\\/2023\\\/03\\\/06\\\/2022-paypal-breach-affects-almost-35000-users-results-in-class-action-lawsuit\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/kentprotect.com\\\/index.php\\\/2023\\\/03\\\/06\\\/2022-paypal-breach-affects-almost-35000-users-results-in-class-action-lawsuit\\\/\"},\"author\":{\"name\":\"Kyler Kent CISSP\",\"@id\":\"https:\\\/\\\/kentprotect.com\\\/#\\\/schema\\\/person\\\/f9b4d76bd2f5b5559a08ad2e004a1116\"},\"headline\":\"2022 PayPal breach affects almost 35,000 users, results in class-action lawsuit\",\"datePublished\":\"2023-03-06T15:53:54+00:00\",\"dateModified\":\"2023-03-06T16:33:10+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/kentprotect.com\\\/index.php\\\/2023\\\/03\\\/06\\\/2022-paypal-breach-affects-almost-35000-users-results-in-class-action-lawsuit\\\/\"},\"wordCount\":543,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/kentprotect.com\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/kentprotect.com\\\/index.php\\\/2023\\\/03\\\/06\\\/2022-paypal-breach-affects-almost-35000-users-results-in-class-action-lawsuit\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/kentprotect.com\\\/wp-content\\\/uploads\\\/2023\\\/03\\\/Louise-Pentland-Article-201809281401.webp\",\"keywords\":[\"account\",\"been pwned\",\"breach report\",\"breaches\",\"california\",\"ciso\",\"class-action\",\"cloud\",\"computer security\",\"credential stuffing\",\"credentialstuffing\",\"cyber security\",\"cybercrime\",\"cybersecurity\",\"dallas\",\"dark web\",\"data breach\",\"digital wallet\",\"digitalwallet\",\"ecommerce\",\"executive\",\"exfiltration\",\"have been pwned\",\"have I pwned\",\"haveibeenpwned\",\"I been pwned\",\"I have been pwned\",\"kent protect\",\"kentprotect\",\"lawsuit\",\"leak\",\"litigation\",\"online\",\"online sales\",\"paypal\",\"purchasing\",\"pwned\",\"san jose\",\"sanjose\",\"security\",\"shopping\",\"summary\"],\"articleSection\":[\"The Breach Report!\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/kentprotect.com\\\/index.php\\\/2023\\\/03\\\/06\\\/2022-paypal-breach-affects-almost-35000-users-results-in-class-action-lawsuit\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/kentprotect.com\\\/index.php\\\/2023\\\/03\\\/06\\\/2022-paypal-breach-affects-almost-35000-users-results-in-class-action-lawsuit\\\/\",\"url\":\"https:\\\/\\\/kentprotect.com\\\/index.php\\\/2023\\\/03\\\/06\\\/2022-paypal-breach-affects-almost-35000-users-results-in-class-action-lawsuit\\\/\",\"name\":\"2022 PayPal breach affects almost 35,000 users, results in class-action lawsuit - Kent Protect\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/kentprotect.com\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/kentprotect.com\\\/index.php\\\/2023\\\/03\\\/06\\\/2022-paypal-breach-affects-almost-35000-users-results-in-class-action-lawsuit\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/kentprotect.com\\\/index.php\\\/2023\\\/03\\\/06\\\/2022-paypal-breach-affects-almost-35000-users-results-in-class-action-lawsuit\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/kentprotect.com\\\/wp-content\\\/uploads\\\/2023\\\/03\\\/Louise-Pentland-Article-201809281401.webp\",\"datePublished\":\"2023-03-06T15:53:54+00:00\",\"dateModified\":\"2023-03-06T16:33:10+00:00\",\"description\":\"A mass credential stuffing attack against Paypal users in December 2022 results in an almost 35,000-user data breach and a class action lawsuit.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/kentprotect.com\\\/index.php\\\/2023\\\/03\\\/06\\\/2022-paypal-breach-affects-almost-35000-users-results-in-class-action-lawsuit\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/kentprotect.com\\\/index.php\\\/2023\\\/03\\\/06\\\/2022-paypal-breach-affects-almost-35000-users-results-in-class-action-lawsuit\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/kentprotect.com\\\/index.php\\\/2023\\\/03\\\/06\\\/2022-paypal-breach-affects-almost-35000-users-results-in-class-action-lawsuit\\\/#primaryimage\",\"url\":\"https:\\\/\\\/kentprotect.com\\\/wp-content\\\/uploads\\\/2023\\\/03\\\/Louise-Pentland-Article-201809281401.webp\",\"contentUrl\":\"https:\\\/\\\/kentprotect.com\\\/wp-content\\\/uploads\\\/2023\\\/03\\\/Louise-Pentland-Article-201809281401.webp\",\"width\":620,\"height\":372,\"caption\":\"Louise Pentland Paypal\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/kentprotect.com\\\/index.php\\\/2023\\\/03\\\/06\\\/2022-paypal-breach-affects-almost-35000-users-results-in-class-action-lawsuit\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/kentprotect.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"2022 PayPal breach affects almost 35,000 users, results in class-action lawsuit\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/kentprotect.com\\\/#website\",\"url\":\"https:\\\/\\\/kentprotect.com\\\/\",\"name\":\"Kent Protect\",\"description\":\"Starring the Breach Report! and other security and cybersecurity series\",\"publisher\":{\"@id\":\"https:\\\/\\\/kentprotect.com\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/kentprotect.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/kentprotect.com\\\/#organization\",\"name\":\"Kent Protect\",\"url\":\"https:\\\/\\\/kentprotect.com\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/kentprotect.com\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/kentprotect.com\\\/wp-content\\\/uploads\\\/2023\\\/04\\\/cropped-FullLogo_Transparent-1-with-KP-Smaller.png\",\"contentUrl\":\"https:\\\/\\\/kentprotect.com\\\/wp-content\\\/uploads\\\/2023\\\/04\\\/cropped-FullLogo_Transparent-1-with-KP-Smaller.png\",\"width\":209,\"height\":161,\"caption\":\"Kent Protect\"},\"image\":{\"@id\":\"https:\\\/\\\/kentprotect.com\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/kentprotect.com\\\/#\\\/schema\\\/person\\\/f9b4d76bd2f5b5559a08ad2e004a1116\",\"name\":\"Kyler Kent CISSP\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/kentprotect.com\\\/wp-content\\\/uploads\\\/2023\\\/03\\\/Retry-3-150x150.jpg\",\"url\":\"https:\\\/\\\/kentprotect.com\\\/wp-content\\\/uploads\\\/2023\\\/03\\\/Retry-3-150x150.jpg\",\"contentUrl\":\"https:\\\/\\\/kentprotect.com\\\/wp-content\\\/uploads\\\/2023\\\/03\\\/Retry-3-150x150.jpg\",\"caption\":\"Kyler Kent CISSP\"},\"description\":\"Kyler Kent is a Senior Cybersecurity Analyst on CrowdStrike\u2019s Falcon Complete MDR team, where he helps large enterprises detect, investigate, and contain real intrusions across cloud and hybrid environments. His work spans threat hunting, incident response, and security automation\u2014turning noisy telemetry into clear, repeatable actions that reduce risk quickly. Previously, Kyler served as a Threat Hunting and Intelligence Specialist supporting a critical infrastructure provider in Dallas, and led security automation and operational coordination at CyberConvoy. He holds a Master\u2019s in Cybersecurity Risk Management from Georgetown University and maintains certifications including CISSP, AWS Solutions Architect \u2013 Professional, AWS Security \u2013 Specialty, and multiple CrowdStrike credentials. He writes to close the gap between \u201cwhat the textbook says\u201d and what analysts actually do on shift with his published book: \\\"SOC Analyst Career Guide\\\" (ISBN-13: 9781835467466). https:\\\/\\\/linktr.ee\\\/kentprotect.com Corrections: corrections@kentprotect.com\",\"sameAs\":[\"http:\\\/\\\/kylerkent.com\"],\"url\":\"https:\\\/\\\/kentprotect.com\\\/index.php\\\/author\\\/kylerkent\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"2022 PayPal breach affects almost 35,000 users, results in class-action lawsuit - Kent Protect","description":"A mass credential stuffing attack against Paypal users in December 2022 results in an almost 35,000-user data breach and a class action lawsuit.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/kentprotect.com\/index.php\/2023\/03\/06\/2022-paypal-breach-affects-almost-35000-users-results-in-class-action-lawsuit\/","og_locale":"en_US","og_type":"article","og_title":"2022 PayPal breach affects almost 35,000 users, results in class-action lawsuit - Kent Protect","og_description":"A mass credential stuffing attack against Paypal users in December 2022 results in an almost 35,000-user data breach and a class action lawsuit.","og_url":"https:\/\/kentprotect.com\/index.php\/2023\/03\/06\/2022-paypal-breach-affects-almost-35000-users-results-in-class-action-lawsuit\/","og_site_name":"Kent Protect","article_published_time":"2023-03-06T15:53:54+00:00","article_modified_time":"2023-03-06T16:33:10+00:00","og_image":[{"width":620,"height":372,"url":"https:\/\/kentprotect.com\/wp-content\/uploads\/2023\/03\/Louise-Pentland-Article-201809281401.webp","type":"image\/webp"}],"author":"Kyler Kent CISSP","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Kyler Kent CISSP","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/kentprotect.com\/index.php\/2023\/03\/06\/2022-paypal-breach-affects-almost-35000-users-results-in-class-action-lawsuit\/#article","isPartOf":{"@id":"https:\/\/kentprotect.com\/index.php\/2023\/03\/06\/2022-paypal-breach-affects-almost-35000-users-results-in-class-action-lawsuit\/"},"author":{"name":"Kyler Kent CISSP","@id":"https:\/\/kentprotect.com\/#\/schema\/person\/f9b4d76bd2f5b5559a08ad2e004a1116"},"headline":"2022 PayPal breach affects almost 35,000 users, results in class-action lawsuit","datePublished":"2023-03-06T15:53:54+00:00","dateModified":"2023-03-06T16:33:10+00:00","mainEntityOfPage":{"@id":"https:\/\/kentprotect.com\/index.php\/2023\/03\/06\/2022-paypal-breach-affects-almost-35000-users-results-in-class-action-lawsuit\/"},"wordCount":543,"commentCount":0,"publisher":{"@id":"https:\/\/kentprotect.com\/#organization"},"image":{"@id":"https:\/\/kentprotect.com\/index.php\/2023\/03\/06\/2022-paypal-breach-affects-almost-35000-users-results-in-class-action-lawsuit\/#primaryimage"},"thumbnailUrl":"https:\/\/kentprotect.com\/wp-content\/uploads\/2023\/03\/Louise-Pentland-Article-201809281401.webp","keywords":["account","been pwned","breach report","breaches","california","ciso","class-action","cloud","computer security","credential stuffing","credentialstuffing","cyber security","cybercrime","cybersecurity","dallas","dark web","data breach","digital wallet","digitalwallet","ecommerce","executive","exfiltration","have been pwned","have I pwned","haveibeenpwned","I been pwned","I have been pwned","kent protect","kentprotect","lawsuit","leak","litigation","online","online sales","paypal","purchasing","pwned","san jose","sanjose","security","shopping","summary"],"articleSection":["The Breach Report!"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/kentprotect.com\/index.php\/2023\/03\/06\/2022-paypal-breach-affects-almost-35000-users-results-in-class-action-lawsuit\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/kentprotect.com\/index.php\/2023\/03\/06\/2022-paypal-breach-affects-almost-35000-users-results-in-class-action-lawsuit\/","url":"https:\/\/kentprotect.com\/index.php\/2023\/03\/06\/2022-paypal-breach-affects-almost-35000-users-results-in-class-action-lawsuit\/","name":"2022 PayPal breach affects almost 35,000 users, results in class-action lawsuit - Kent Protect","isPartOf":{"@id":"https:\/\/kentprotect.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/kentprotect.com\/index.php\/2023\/03\/06\/2022-paypal-breach-affects-almost-35000-users-results-in-class-action-lawsuit\/#primaryimage"},"image":{"@id":"https:\/\/kentprotect.com\/index.php\/2023\/03\/06\/2022-paypal-breach-affects-almost-35000-users-results-in-class-action-lawsuit\/#primaryimage"},"thumbnailUrl":"https:\/\/kentprotect.com\/wp-content\/uploads\/2023\/03\/Louise-Pentland-Article-201809281401.webp","datePublished":"2023-03-06T15:53:54+00:00","dateModified":"2023-03-06T16:33:10+00:00","description":"A mass credential stuffing attack against Paypal users in December 2022 results in an almost 35,000-user data breach and a class action lawsuit.","breadcrumb":{"@id":"https:\/\/kentprotect.com\/index.php\/2023\/03\/06\/2022-paypal-breach-affects-almost-35000-users-results-in-class-action-lawsuit\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/kentprotect.com\/index.php\/2023\/03\/06\/2022-paypal-breach-affects-almost-35000-users-results-in-class-action-lawsuit\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/kentprotect.com\/index.php\/2023\/03\/06\/2022-paypal-breach-affects-almost-35000-users-results-in-class-action-lawsuit\/#primaryimage","url":"https:\/\/kentprotect.com\/wp-content\/uploads\/2023\/03\/Louise-Pentland-Article-201809281401.webp","contentUrl":"https:\/\/kentprotect.com\/wp-content\/uploads\/2023\/03\/Louise-Pentland-Article-201809281401.webp","width":620,"height":372,"caption":"Louise Pentland Paypal"},{"@type":"BreadcrumbList","@id":"https:\/\/kentprotect.com\/index.php\/2023\/03\/06\/2022-paypal-breach-affects-almost-35000-users-results-in-class-action-lawsuit\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/kentprotect.com\/"},{"@type":"ListItem","position":2,"name":"2022 PayPal breach affects almost 35,000 users, results in class-action lawsuit"}]},{"@type":"WebSite","@id":"https:\/\/kentprotect.com\/#website","url":"https:\/\/kentprotect.com\/","name":"Kent Protect","description":"Starring the Breach Report! and other security and cybersecurity series","publisher":{"@id":"https:\/\/kentprotect.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/kentprotect.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/kentprotect.com\/#organization","name":"Kent Protect","url":"https:\/\/kentprotect.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/kentprotect.com\/#\/schema\/logo\/image\/","url":"https:\/\/kentprotect.com\/wp-content\/uploads\/2023\/04\/cropped-FullLogo_Transparent-1-with-KP-Smaller.png","contentUrl":"https:\/\/kentprotect.com\/wp-content\/uploads\/2023\/04\/cropped-FullLogo_Transparent-1-with-KP-Smaller.png","width":209,"height":161,"caption":"Kent Protect"},"image":{"@id":"https:\/\/kentprotect.com\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/kentprotect.com\/#\/schema\/person\/f9b4d76bd2f5b5559a08ad2e004a1116","name":"Kyler Kent CISSP","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/kentprotect.com\/wp-content\/uploads\/2023\/03\/Retry-3-150x150.jpg","url":"https:\/\/kentprotect.com\/wp-content\/uploads\/2023\/03\/Retry-3-150x150.jpg","contentUrl":"https:\/\/kentprotect.com\/wp-content\/uploads\/2023\/03\/Retry-3-150x150.jpg","caption":"Kyler Kent CISSP"},"description":"Kyler Kent is a Senior Cybersecurity Analyst on CrowdStrike\u2019s Falcon Complete MDR team, where he helps large enterprises detect, investigate, and contain real intrusions across cloud and hybrid environments. His work spans threat hunting, incident response, and security automation\u2014turning noisy telemetry into clear, repeatable actions that reduce risk quickly. Previously, Kyler served as a Threat Hunting and Intelligence Specialist supporting a critical infrastructure provider in Dallas, and led security automation and operational coordination at CyberConvoy. He holds a Master\u2019s in Cybersecurity Risk Management from Georgetown University and maintains certifications including CISSP, AWS Solutions Architect \u2013 Professional, AWS Security \u2013 Specialty, and multiple CrowdStrike credentials. He writes to close the gap between \u201cwhat the textbook says\u201d and what analysts actually do on shift with his published book: \"SOC Analyst Career Guide\" (ISBN-13: 9781835467466). https:\/\/linktr.ee\/kentprotect.com Corrections: corrections@kentprotect.com","sameAs":["http:\/\/kylerkent.com"],"url":"https:\/\/kentprotect.com\/index.php\/author\/kylerkent\/"}]}},"_links":{"self":[{"href":"https:\/\/kentprotect.com\/index.php\/wp-json\/wp\/v2\/posts\/267","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/kentprotect.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kentprotect.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kentprotect.com\/index.php\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/kentprotect.com\/index.php\/wp-json\/wp\/v2\/comments?post=267"}],"version-history":[{"count":2,"href":"https:\/\/kentprotect.com\/index.php\/wp-json\/wp\/v2\/posts\/267\/revisions"}],"predecessor-version":[{"id":272,"href":"https:\/\/kentprotect.com\/index.php\/wp-json\/wp\/v2\/posts\/267\/revisions\/272"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/kentprotect.com\/index.php\/wp-json\/wp\/v2\/media\/269"}],"wp:attachment":[{"href":"https:\/\/kentprotect.com\/index.php\/wp-json\/wp\/v2\/media?parent=267"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kentprotect.com\/index.php\/wp-json\/wp\/v2\/categories?post=267"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kentprotect.com\/index.php\/wp-json\/wp\/v2\/tags?post=267"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}