Hackers Claim Theft of 15.8M PayPal Login Credentials

A group of hackers claims to have breached PayPal and is offering a dataset of 15.8 million credentials on the deep web. The threat actor behind the allegedly stolen data insists it is up to date and describes it as a “goldmine” for cybercriminals. PayPal denies the breach.

According to Hackread.com, a user named Chucky_BF is selling a massive data collection titled “Global PayPal Credential Dump 2025” on a popular hacker forum. The threat actor claims the dataset is 1.1 GB in size and contains emails, URLs, and password combinations in plain text from users worldwide. The listing also references Android-specific URIs and endpoints such as /signin, /connect, and /signup — suggesting a structure that could make it easier for cybercriminals to exploit accounts.

Chucky_BF is offering full access to the “Global PayPal Credential Dump 2025” for $750. In a sample shared by the hacker, a list shows email addresses and passwords linked to PayPal login pages, as well as proof that the credentials work on both mobile and desktop versions. The hacker added that most passwords appear to be unique, although some may be reused.

“If the claims are accurate, this would represent one of the larger PayPal-focused leaks of recent years,” wrote cybersecurity expert Waqas for Hackread. He also suggested that, if a breach occurred, it was most likely the result of infostealer malware, since PayPal’s core systems have not previously been compromised.

PayPal has faced accusations of cybersecurity negligence before, after a December 2022 incident exposed the personal information of around 35,000 users. The company was hit by a class-action lawsuit in the United States in 2023, and in January this year, New York State's Department of Financial Services fined it $2 million over the incident.

According to Cybernews, PayPal has denied the latest breach — Chucky_BF claims it’s from May 2025 — and said the data being sold is old. “There has been no data breach – this is related to an incident in 2022 and not new,” said PayPal to Cybernews.

The claims remain unverified. Experts, including Troy Hunt, a cybersecurity expert and the creator of Have I Been Pwned, suggest the PayPal credentials could have been harvested by infostealers, collected through credential stuffing, or simply fabricated by the anonymous seller.