PayPal Warns 35,000 Users of Credential Stuffing Attacks
House › Cybercrime
PayPal Warns 35,000 Customers of Credential Stuffing Assaults
By Ionut Arghire on January 20, 2023
Tweet
On-line funds system PayPal is alerting roughly 35,000 people that their accounts have been focused in a credential stuffing marketing campaign.
“On December 20, 2022, we confirmed that unauthorized events have been in a position to entry your PayPal buyer account utilizing your login credentials,” the corporate mentioned within the notification letter despatched to the impacted people.
In response to PayPal, between December 6 and eight, 2022, a 3rd celebration accessed consumer accounts utilizing login credentials obtained elsewhere. The unauthorized entry was eradicated on December 8.
The corporate says the attackers probably obtained the login credentials through phishing or associated nefarious exercise, because it discovered no proof that the corporate’s techniques have been breached.
The attackers, the corporate says, have been in a position to entry and probably steal private info from the sufferer accounts, together with names, addresses, cellphone numbers, beginning dates, particular person tax identification numbers, and Social Safety numbers.
“As of the time of writing, we’ve got no info suggesting that any private info was misused on account of this incident, nor have there been unauthorized transactions on the affected accounts,” PayPal instructed the Maine Legal professional Basic’s Workplace.
The web funds platform says it reset the passwords for the impacted consumer accounts and carried out “enhanced safety controls to stop any additional unauthorized entry”.
“We now have not knowledgeable legislation enforcement of this incident, and this notification was not delayed on account of a legislation enforcement investigation,” PayPal mentioned.
The corporate instructed the Maine Legal professional Basic {that a} whole of 34,942 people have been impacted within the incident.
In credential stuffing assaults, risk actors use leaked credentials obtained from a third-party supply (typically bought on hacker boards) to entry consumer accounts on completely different companies. Such assaults are doable because of the reuse of credentials throughout a number of companies.
Associated: DraftKings Information Breach Impacts Private Info of 68,000 Prospects
Associated: FBI Warns of Proxies and Configurations Utilized in Credential Stuffing Assaults
Associated: NY AG: Credential Stuffing Impacts 1.1 Million Customers at 17 Corporations
Get the Each day Briefing
- Most Current
- Most Learn
- In-the-Wild Exploitation of Current ManageEngine Vulnerability Commences
- Subtle ‘VastFlux’ Advert Fraud Scheme That Spoofed 1,700 Apps Disrupted
- Vital Vulnerabilities Patched in OpenText Enterprise Content material Administration System
- EU’s Breton Warns TikTok CEO: Comply With New Digital Guidelines
- PayPal Warns 35,000 Customers of Credential Stuffing Assaults
- Ransomware Income Plunged in 2022 as Extra Victims Refuse to Pay Up: Report
- Chinese language Hackers Exploited Fortinet VPN Vulnerability as Zero-Day
- A Change in Mindset: From a Menace-based to Danger-based Strategy to Safety
- Ransomware Shuts A whole lot of Yum Manufacturers Eating places in UK
- Drupal Patches Vulnerabilities Resulting in Info Disclosure
On the lookout for Malware in All of the Incorrect Locations?
First Step For The Web’s subsequent 25 years: Including Safety to the DNS
Tattle Story: What Your Pc Says About You
Be in a Place to Act By way of Cyber Situational Consciousness
Report Exhibits Closely Regulated Industries Letting Social Networking Apps Run Rampant
2010, A Nice Yr To Be a Scammer.
Do not Let DNS be Your Single Level of Failure
Find out how to Determine Malware in a Blink
Defining and Debating Cyber Warfare
The 5 A’s that Make Cybercrime so Engaging
Find out how to Defend Towards DDoS Assaults
Safety Budgets Not in Line with Threats
Anycast – Three Causes Why Your DNS Community Ought to Use It
The Evolution of the Prolonged Enterprise: Safety Methods for Ahead Pondering Organizations
Utilizing DNS Throughout the Prolonged Enterprise: It’s Dangerous Enterprise
SecurityWeek Podcast
