10 ms·

PayPal data breach notification

200 points by pmoriarty 4y ago

Beestie 4y ago
Awesome. They are providing 24 mo identity theft protection by Equifax. So the day after the fox broke into the henhouse, they are going to secure the premises by adding a sign: "Please do not eat the chickens" Gotta hand it to Equifax, they know how to sell nothing for something.
progbits 4y ago
Two weeks to detect (not great), another month to disclose (worse). "Only" 35k affected so must be some narrow scope. The linked page doesn't seem to provide more details.
- Zetobal 4y ago
  There was nothing to detect and there was nothing to disclose it was a stuffing attack. The fallout of another company's breach, they took the proactive course of action to mitigate and inform their customers it should be applauded and not condemned.
  - progbits 4y ago
    Apparently I can't read today, sorry for the stupid comment. Can't edit it anymore.
snorremd 4y ago
If I read this correctly this is a case of credential stuffing meaning the breach isn't really related to PayPal as much as people had credentials stolen other places and had used the same ones at PayPal. Maybe PayPal needs to enforce 2FA if they don't already do. 2FA SMS factor should be discontinued for any financial or otherwise important/sensitive service as SIM jacking is apparently quite easy. But anyone with properly secured accounts seems to not have been affected by this breach.
- kennydude 4y ago
  PayPal, at least for me, forces FaceID and an SMS 2FA to access it at all which is crazy. Probably would be great if they moved away from SMS though :(
  - perch56 4y ago
    You can enable or disable FaceI ID from the settings. Just curious, why is using Face ID crazy?
- toastal 4y ago
  I've had to ignore my account. I originally want TOTP 2FA, but it wasn't an option. I set up 2FA through Google Voice because my number changes frequently. A few years later I tried to log in and Google Voice has been blocked as a 2FA option for SMS. I go to seek support and you, circularly, need to be authenticated to get support for authentication, and asking support on Twitter got me banned from their account. The last 2 years directly emailed all independent sellers to set up alternative payment options to not go through such a careless operation.
  - gorbachev 4y ago
    Same. Can not log into my Paypal account any more, because they don't accept Google Voice numbers as valid phone numbers any longer.
  - eloff 4y ago
    Always have a backup payment processor. PayPal especially, but even Stripe will shut you down or freeze your balance with little recourse. Amazon killed my parents business by just sheer incompetence and support took a year to get partially back to operation, by which time it was over. Facebook incorrectly nuked my wife’s Instagram account and hopes of becoming an influencer. No recourse. Google can ban your account with your email with no recourse. You lose your email history, contacts, documents, etc with no way to login to a myriad of online services. I’m really low on patience with the big tech companies. I hope the government reins them in.
survirtual 4y ago
[flagged]
- phoe-krk 4y ago
  And people (especially here on HN) really can't see why so many are invested in and believe in actual money? Your shitcoins are being hoarded by incompetent people in giant, minimally secured exchanges not to provide you with a better service, but to make a very small number of people bucket loads of money. They put in minimal viable effort to provide a minimal viable service and make money hand over fist without consequence when their incompetence result in your cryptocurrencies that you entrusted them with being rug-pulled. Once that crypto is “compromised” it is free for the attacker to use for any reason, outside the ToS defined by the exchanges. They are not held accountable, there is a proven record of no oversight nor any accountability. Do you really wonder why people are putting their faith and confidence in actually regulated currencies as opposed to these joke shitcoins? Look around you. The Web3 is going great[0]. Get out while you still can. [0] https://web3isgoinggreat.com/ https://web3isgoinggreat.com/
  - rajamaka 4y ago
    The common retort to this is, "well you should be holding your coins in your own physical wallet". Usually from a person who stores their life saving of dogecoin in some weird 25% APR Ponzi.
    - danuker 4y ago
      Ah, I remember the Ledger customer data leak. Just as incompetent, even for a hardware wallet.
  - frankenst1 4y ago
    Just use Bitcoin. Don't trust anyone except yourself. You can store your coins in your phone, hardware wallet, paper wallet. You can encode it in steel and bury it in your backyard. You can "horcrux" them (e.g. via MultiSig or SSS) and store the parts (and copies of them) at different locations (friends, family, attorney, ...). Or put them in a safe deposit box if you like. Put a small amount on your phone and you can send them in seconds via the Lightning Network to anyone in the world at minimal fees, without relying on or needing permission from anybody else. Few actual need custodial services and nobody needs the greedy shitcoin casino. Decentralize. Be your own bank.
looseyesterday 4y ago
What are the chances this is bigger than they claim?
londons_explore 4y ago
Most companies wouldn't even act on a credential stuffing attack against their users. They'd shrug and say 'not our problem if our users don't secure their passwords properly'. Kudos to Paypal here for considering it a breach, and reporting it as such.
- fmajid 4y ago
  And I'd agree. Their lawyers probably made them do it.
  - londons_explore 4y ago
    As a bank, your agreements are with the actual humans, and your duty is to protect their money. The fact that you choose to use usernames and passwords to authenticate humans is your choice. It is well known that humans don't secure passwords well (reuse, writing on postit notes, etc). As a bank, any losses attributable to someone evil finding/guessing a password are your own. That's why credential stuffing counts as a breach. Even though most banks will try to tell you that it's your responsibility to protect your passwords, the law doesn't see it that way.
    - bob1029 4y ago
      > As a bank Technically, Paypal is not regulated as a bank (per FDIC). That said, they certainly have immense fiduciary & privacy duty to their customers considering the format of their business.
      - moxli 4y ago
        > Technically, Paypal is not regulated as a bank PayPal has a banking license in Luxembourg which allows them to operate in Europe. I guess it depends on the region/country.
    - boring_twenties 4y ago
      Well that sucks for those of us who can use passwords effectively, instead we all get this SMS 2FA crap which is both more annoying and less secure.
alpos 4y ago
"We have also secured the services of Equifax to provide identity monitoring services at no cost to you for two years. Below please find information on signing up for a complimentary membership to Equifax’s identity monitoring services, including key product features" Really PayPal? You mean this Equifax? https://en.wikipedia.org/wiki/2017_Equifax_data_breach https://en.wikipedia.org/wiki/2017_Equifax_data_breach The security breach problem altogether has been turned in to a source of extra profit for the credit reporting companies whose faulty systems, lack of data verification, and resulting poor data quality are the root cause of these issues in the first place. The problem has never been "oh no someone stole your identity!". Identity can not be stolen, only temporarily misattributed in the eyes of one party or another. The actual problem is that companies like banks and credit card issuers don't actually know who they are dealing with and don't want to put any effort in to verifying that. Using just a few pieces of already available, static information about a customer was never enough to say you actually know who your company is signing a contract with. Calling it "identity theft" when someone feeds your faulty signup process incorrect information is merely a means of passing the problem with your systems off to the customer. Now we're going as far as pretending the root cause of this stupidity can also sell us the cure? Nonsense. If anyone ever "steals my identity", I'm going to sue the credit reporters for libel. They have admitted before that some 70% of their records contain inaccurate information and they know full well that a few bits of static information is not enough the identify an individual among hundreds of millions. They also know they don't do anything to establish that any new reports coming in from partner businesses are actually real and accurate. Yet they still peddle that inaccurate information to third parties. That is the same as if a journalist made up a story saying you did some shit you didn't do. They are knowingly giving out information about a person that is either provably false or which they have no good reason to believe is true in a way that can cause financial harm and loss of reputation. Classic libel. Further, if some business reported that I took a loan from them when I didn't, that isn't my problem, it's theirs. They failed to adequately verify who they were dealing with. Not my problem. Reporting that inaccuracy to a third party who then broadcasts that to a bunch of other companies, is also libel. They can make a case that they didn't know for sure that their claim that I owe them was false at the time, but they actually never had a good reason to believe it was true. Static information alone, especially that which we already know is in circulation among public entities, is not a valid way of identifying who you are dealing with. Pretending that it is anyway is just bad business. People need to hold these businesses accountable for the damage their faulty system designs are causing.
seagull-action 4y ago
I personally wouldn't call it a data breach as such if it's just credential stuffing, but it's great that Paypal put out a notice on it so their customers are aware.
gggggg5 4y ago
Requiring businesses to file breach notifications over credential stuffing attacks seems completely insane to me. What's next? Breach notifications over phishing campaigns? Perhaps the goal is to render breach notifications useless by flooding them with nonsense like this?
- RhodesianHunter 4y ago
  What's insane is thinking that a bank that handles people's money shouldn't be required to report a coordinated successful attack, regardless of whether their technology is at fault.
  - gggggg5 4y ago
    There are thousands of coordinated successful phishing campaigns going on against Paypal every day, what value would that reporting provide to anyone?
  - prophesi 4y ago
    If all it takes is someone to download one of the countless publicly-available-on-github plaintext password compilations and automate login attempts to require a company to file a breach notification, I think all of the top services in the world would have to file one every hour.
dgudkov 4y ago
Tried to configure 2FA on PayPal. Adding only 1 authenticator app is allowed (why not more?). Failed to recognize Yubikey in Firefox. It's a leading payment processor. They have lots of money and developers. The state of things is pity.
- Terretta 4y ago
  Who engineered this thing? It's not like it's rocket science. Oh wait…
scrps 4y ago
Wondering if this isn't related to the LastPass breach? Paypal's 2FA is a bit of a joke. IIRC (this was quite some time ago) when I went to initially setup 2FA SMS was the only option, eventually they added support for authenticators but you can just click get a text instead of the authenticator. Last time I checked there was no way to tell paypal to only accept OTPs from an authenticator.
- troymc 4y ago
  Probably not. "Credential stuffing" means getting a big list of formerly-leaked usernames and passwords and trying them everywhere. It mainly targets people who use low-entropy passwords or who reuse the same password on multiple sites.
app4soft 4y ago
Meanwhile Twitter hides my tweets about PayPal.Me still working in Russia.[0] [0] https://news.ycombinator.com/item?id=34531489#34531574 https://news.ycombinator.com/item?id=34531489#34531574
TrickardRixx 4y ago
PayPal previously refused to acknowledge a 2FA bypass vulnerability submitted to their HackerOne program. https://cybernews.com/security/we-found-6-critical-paypal-vulnerabilities-and-paypal-punished-us/ https://cybernews.com/security/we-found-6-critical-paypal-vu...
yalogin 4y ago
Why do companies offer only 2yrs of identity protection coverage for breaches? There are tons of these happening and so people can wait a couple of years to use them if it's going to be less of a hassle. Ofcourse, I don't trust that the identity protection coverage is of any use, but still trying to think about the effectiveness of the data after 2 years. Is there a reason to believe the information is not useful after 2 yrs? Why the 2yrs? It should be at least 10yrs if not more to be meaningful.
- autoexec 4y ago
  > Why do companies offer only 2yrs of identity protection coverage for breaches? Two years seems like the minimum they feel they can get away with. They just need to make it seem like they've done "something" to compensate their victims out of fear that if they didn't some regulation will come along that requires that they actually make up for the harm their negligence has caused in an actually meaningful (and more costly) way.
mrguyorama 4y ago
As a resident of the state in question, I'm curious as to why this comes from our state. Did paypal not have to report this anywhere else?

200 points by pmoriarty 4y ago

Awesome. They are providing 24 mo identity theft protection by Equifax. So the day after the fox broke into the henhouse, they are going to secure the premises by adding a sign: "Please do not eat the chickens" Gotta hand it to Equifax, they know how to sell nothing for something.

progbits 4y ago

Two weeks to detect (not great), another month to disclose (worse). "Only" 35k affected so must be some narrow scope. The linked page doesn't seem to provide more details.

Zetobal 4y ago
There was nothing to detect and there was nothing to disclose it was a stuffing attack. The fallout of another company's breach, they took the proactive course of action to mitigate and inform their customers it should be applauded and not condemned.
- progbits 4y ago
  Apparently I can't read today, sorry for the stupid comment. Can't edit it anymore.

snorremd 4y ago

If I read this correctly this is a case of credential stuffing meaning the breach isn't really related to PayPal as much as people had credentials stolen other places and had used the same ones at PayPal. Maybe PayPal needs to enforce 2FA if they don't already do. 2FA SMS factor should be discontinued for any financial or otherwise important/sensitive service as SIM jacking is apparently quite easy. But anyone with properly secured accounts seems to not have been affected by this breach.

kennydude 4y ago
PayPal, at least for me, forces FaceID and an SMS 2FA to access it at all which is crazy. Probably would be great if they moved away from SMS though :(
- perch56 4y ago
  You can enable or disable FaceI ID from the settings. Just curious, why is using Face ID crazy?
toastal 4y ago
I've had to ignore my account. I originally want TOTP 2FA, but it wasn't an option. I set up 2FA through Google Voice because my number changes frequently. A few years later I tried to log in and Google Voice has been blocked as a 2FA option for SMS. I go to seek support and you, circularly, need to be authenticated to get support for authentication, and asking support on Twitter got me banned from their account. The last 2 years directly emailed all independent sellers to set up alternative payment options to not go through such a careless operation.
- gorbachev 4y ago
  Same. Can not log into my Paypal account any more, because they don't accept Google Voice numbers as valid phone numbers any longer.
- eloff 4y ago
  Always have a backup payment processor. PayPal especially, but even Stripe will shut you down or freeze your balance with little recourse. Amazon killed my parents business by just sheer incompetence and support took a year to get partially back to operation, by which time it was over. Facebook incorrectly nuked my wife’s Instagram account and hopes of becoming an influencer. No recourse. Google can ban your account with your email with no recourse. You lose your email history, contacts, documents, etc with no way to login to a myriad of online services. I’m really low on patience with the big tech companies. I hope the government reins them in.

survirtual 4y ago

[flagged]

phoe-krk 4y ago
And people (especially here on HN) really can't see why so many are invested in and believe in actual money? Your shitcoins are being hoarded by incompetent people in giant, minimally secured exchanges not to provide you with a better service, but to make a very small number of people bucket loads of money. They put in minimal viable effort to provide a minimal viable service and make money hand over fist without consequence when their incompetence result in your cryptocurrencies that you entrusted them with being rug-pulled. Once that crypto is “compromised” it is free for the attacker to use for any reason, outside the ToS defined by the exchanges. They are not held accountable, there is a proven record of no oversight nor any accountability. Do you really wonder why people are putting their faith and confidence in actually regulated currencies as opposed to these joke shitcoins? Look around you. The Web3 is going great[0]. Get out while you still can. [0] https://web3isgoinggreat.com/ https://web3isgoinggreat.com/
- rajamaka 4y ago
  The common retort to this is, "well you should be holding your coins in your own physical wallet". Usually from a person who stores their life saving of dogecoin in some weird 25% APR Ponzi.
  - danuker 4y ago
    Ah, I remember the Ledger customer data leak. Just as incompetent, even for a hardware wallet.
- frankenst1 4y ago
  Just use Bitcoin. Don't trust anyone except yourself. You can store your coins in your phone, hardware wallet, paper wallet. You can encode it in steel and bury it in your backyard. You can "horcrux" them (e.g. via MultiSig or SSS) and store the parts (and copies of them) at different locations (friends, family, attorney, ...). Or put them in a safe deposit box if you like. Put a small amount on your phone and you can send them in seconds via the Lightning Network to anyone in the world at minimal fees, without relying on or needing permission from anybody else. Few actual need custodial services and nobody needs the greedy shitcoin casino. Decentralize. Be your own bank.

looseyesterday 4y ago

What are the chances this is bigger than they claim?

londons_explore 4y ago

Most companies wouldn't even act on a credential stuffing attack against their users. They'd shrug and say 'not our problem if our users don't secure their passwords properly'. Kudos to Paypal here for considering it a breach, and reporting it as such.

fmajid 4y ago
And I'd agree. Their lawyers probably made them do it.
- londons_explore 4y ago
  As a bank, your agreements are with the actual humans, and your duty is to protect their money. The fact that you choose to use usernames and passwords to authenticate humans is your choice. It is well known that humans don't secure passwords well (reuse, writing on postit notes, etc). As a bank, any losses attributable to someone evil finding/guessing a password are your own. That's why credential stuffing counts as a breach. Even though most banks will try to tell you that it's your responsibility to protect your passwords, the law doesn't see it that way.
  - bob1029 4y ago
    > As a bank Technically, Paypal is not regulated as a bank (per FDIC). That said, they certainly have immense fiduciary & privacy duty to their customers considering the format of their business.
    - moxli 4y ago
      > Technically, Paypal is not regulated as a bank PayPal has a banking license in Luxembourg which allows them to operate in Europe. I guess it depends on the region/country.
  - boring_twenties 4y ago
    Well that sucks for those of us who can use passwords effectively, instead we all get this SMS 2FA crap which is both more annoying and less secure.

alpos 4y ago

"We have also secured the services of Equifax to provide identity monitoring services at no cost to you for two years. Below please find information on signing up for a complimentary membership to Equifax’s identity monitoring services, including key product features" Really PayPal? You mean this Equifax? https://en.wikipedia.org/wiki/2017_Equifax_data_breach https://en.wikipedia.org/wiki/2017_Equifax_data_breach The security breach problem altogether has been turned in to a source of extra profit for the credit reporting companies whose faulty systems, lack of data verification, and resulting poor data quality are the root cause of these issues in the first place. The problem has never been "oh no someone stole your identity!". Identity can not be stolen, only temporarily misattributed in the eyes of one party or another. The actual problem is that companies like banks and credit card issuers don't actually know who they are dealing with and don't want to put any effort in to verifying that. Using just a few pieces of already available, static information about a customer was never enough to say you actually know who your company is signing a contract with. Calling it "identity theft" when someone feeds your faulty signup process incorrect information is merely a means of passing the problem with your systems off to the customer. Now we're going as far as pretending the root cause of this stupidity can also sell us the cure? Nonsense. If anyone ever "steals my identity", I'm going to sue the credit reporters for libel. They have admitted before that some 70% of their records contain inaccurate information and they know full well that a few bits of static information is not enough the identify an individual among hundreds of millions. They also know they don't do anything to establish that any new reports coming in from partner businesses are actually real and accurate. Yet they still peddle that inaccurate information to third parties. That is the same as if a journalist made up a story saying you did some shit you didn't do. They are knowingly giving out information about a person that is either provably false or which they have no good reason to believe is true in a way that can cause financial harm and loss of reputation. Classic libel. Further, if some business reported that I took a loan from them when I didn't, that isn't my problem, it's theirs. They failed to adequately verify who they were dealing with. Not my problem. Reporting that inaccuracy to a third party who then broadcasts that to a bunch of other companies, is also libel. They can make a case that they didn't know for sure that their claim that I owe them was false at the time, but they actually never had a good reason to believe it was true. Static information alone, especially that which we already know is in circulation among public entities, is not a valid way of identifying who you are dealing with. Pretending that it is anyway is just bad business. People need to hold these businesses accountable for the damage their faulty system designs are causing.

seagull-action 4y ago

I personally wouldn't call it a data breach as such if it's just credential stuffing, but it's great that Paypal put out a notice on it so their customers are aware.

gggggg5 4y ago

Requiring businesses to file breach notifications over credential stuffing attacks seems completely insane to me. What's next? Breach notifications over phishing campaigns? Perhaps the goal is to render breach notifications useless by flooding them with nonsense like this?

RhodesianHunter 4y ago
What's insane is thinking that a bank that handles people's money shouldn't be required to report a coordinated successful attack, regardless of whether their technology is at fault.
- gggggg5 4y ago
  There are thousands of coordinated successful phishing campaigns going on against Paypal every day, what value would that reporting provide to anyone?
- prophesi 4y ago
  If all it takes is someone to download one of the countless publicly-available-on-github plaintext password compilations and automate login attempts to require a company to file a breach notification, I think all of the top services in the world would have to file one every hour.

dgudkov 4y ago

Tried to configure 2FA on PayPal. Adding only 1 authenticator app is allowed (why not more?). Failed to recognize Yubikey in Firefox. It's a leading payment processor. They have lots of money and developers. The state of things is pity.

Terretta 4y ago
Who engineered this thing? It's not like it's rocket science. Oh wait…

scrps 4y ago

Wondering if this isn't related to the LastPass breach? Paypal's 2FA is a bit of a joke. IIRC (this was quite some time ago) when I went to initially setup 2FA SMS was the only option, eventually they added support for authenticators but you can just click get a text instead of the authenticator. Last time I checked there was no way to tell paypal to only accept OTPs from an authenticator.

troymc 4y ago
Probably not. "Credential stuffing" means getting a big list of formerly-leaked usernames and passwords and trying them everywhere. It mainly targets people who use low-entropy passwords or who reuse the same password on multiple sites.

app4soft 4y ago

Meanwhile Twitter hides my tweets about PayPal.Me still working in Russia.[0] [0] https://news.ycombinator.com/item?id=34531489#34531574 https://news.ycombinator.com/item?id=34531489#34531574

TrickardRixx 4y ago

PayPal previously refused to acknowledge a 2FA bypass vulnerability submitted to their HackerOne program. https://cybernews.com/security/we-found-6-critical-paypal-vulnerabilities-and-paypal-punished-us/ https://cybernews.com/security/we-found-6-critical-paypal-vu...

yalogin 4y ago

Why do companies offer only 2yrs of identity protection coverage for breaches? There are tons of these happening and so people can wait a couple of years to use them if it's going to be less of a hassle. Ofcourse, I don't trust that the identity protection coverage is of any use, but still trying to think about the effectiveness of the data after 2 years. Is there a reason to believe the information is not useful after 2 yrs? Why the 2yrs? It should be at least 10yrs if not more to be meaningful.

autoexec 4y ago
> Why do companies offer only 2yrs of identity protection coverage for breaches? Two years seems like the minimum they feel they can get away with. They just need to make it seem like they've done "something" to compensate their victims out of fear that if they didn't some regulation will come along that requires that they actually make up for the harm their negligence has caused in an actually meaningful (and more costly) way.

mrguyorama 4y ago

As a resident of the state in question, I'm curious as to why this comes from our state. Did paypal not have to report this anywhere else?