2022 Credential stuffing — 35,000 records
Data compromised
Names, addresses, SSNs, tax IDs, DOB
Technical writeup
Dec 6–8, 2022. Credential stuffing attack using credentials from other breaches. Exposed: names, addresses, SSNs, tax IDs, DOB. Vulnerability from American Rescue Plan Act changes not properly security-reviewed. NY regulators fined PayPal $2M (2025). Two years Equifax identity monitoring offered.
Root cause
Credential stuffing; inadequate security review of ARPA changes.