15.8 million PayPal accounts at risk: stolen passwords put up for sale

A hacker going by the name Chucky_BF has allegedly stolen details for 15.8 million PayPal accounts and is selling them on an internet forum at a bargain price of just $750 USD. The treasure trove of data, which is being stored in a TXT file, is said to be 1.1 GB in size. However, the authenticity of the PayPal data has not yet been confirmed.

You can see a screenshot of the offer in this social media post . According to the hacker, the PayPal passwords are available in plain text and the email addresses of these PayPal accounts originate from Gmail, Yahoo!, Hotmail, and various country-specific domains.

How the stolen PayPal data was acquired

As of this writing, the hacker hasn’t said where the data came from or how much of it is still up to date.

In this social media post, well-known security expert Troy Hunt suspects that the hacker didn’t steal the data directly from PayPal’s servers since PayPal doesn’t store passwords in plaintext. Most likely they were taken from users, perhaps via infostealer malware.

According to security site Hackread, which checked some of the data, there are some test accounts and fake accounts interspersed among the PayPal accounts, but many are genuine.

Looking at the PayPal Newsroom, the company has not yet issued a statement about this as of this writing.

Here’s what you should do now

If you have a PayPal account, you should immediately go check your transaction history and account settings for any suspicious activity. You should also change your PayPal password ASAP—and if you use the same password for other accounts, you should change those account passwords as well. Consider your password compromised.

Further reading: Careful! That PayPal email could be a phishing scam