Not to say that Paypal's security is flawless, but it also depends on your wife's behaviors as well. Not having it attached to her PayPal reduces the attack su

Not to say that Paypal's security is flawless, but it also depends on your wife's behaviors as well. Not having it attached to her PayPal reduces the attack surface a bit which isn't a bad thing. It's also completely possible that it either wasn't stolen from PayPal or that an unrelated breach (reused passwords on a compromised site etc) allowed someone to access the PayPal account.