PayPal fined $2M for exposing thousands of customers’ SSN

[CRAIG NIGRELLI]

PAYPAL IS PAYING UP FOR FAILING TO PROTECT TENS OF THOUSANDS OF CUSTOMERS’ SENSITIVE PERSONAL INFORMATION.

NEW YORK STATE’S DEPARTMENT OF FINANCIAL SERVICES ANNOUNCED THURSDAY THE COMPANY WILL PAY A TWO-MILLION DOLLARS FINE FOR CYBERSECURITY FAILURES IN 2022 EXPOSING CUSTOMERS SOCIAL SECURITY NUMBERS.

THE FINE IS FOR VIOLATING THE DEPARTMENT’S CYBERSECURITY REGULATION IMPLEMENTED IN 2017.

A PROBE BY THE DEPARTMENT OF FINANCIAL SERVICES FOUND PAYPAL DID NOT USE QUALIFIED STAFF TO MANAGE CRUCIAL CYBERSECURITY FUNCTIONS OR PROVIDE PROPER TRAINING TO PROTECT AGAINST CYBERSECURITY RISKS.

THE FINANCIAL SERVICE’S SUPERINTENDENT SAID SYSTEMIC FAILURES LED TO DATES OF BIRTH AND SOCIAL SECURITY NUMBERS BELONGING TO PAYPAL CUSTOMERS TO BECOME EXPOSED TO CYBER-CRIMINALS FOR AROUND SEVEN WEEKS.

PAYPAL WAS ALERTED TO THE PROBLEM AFTER A SECURITY ANALYST READ AN ONLINE MESSAGE SAYING QUOTE: “P-P EXPLOIT TO GET S-S-N.”

THE FOLLOWING DAY, PAYPAL’S CYBERSECURITY TEAM SAW A SURGE IN ATTEMPTS TO HACK ITS ONLINE PLATFORM AS CYBERCRIMINALS USED STOLEN DATA TO ACCESS THE FEDERAL TAX FORMS OF TENS OF THOUSANDS OF CUSTOMERS.

THE PROBE ALSO FOUND PROBLEMS WITH PAYPAL’S FORMER PRACTICE OF NOT REQUIRING CUSTOMERS TO USE MULTIFACTOR AUTHENTICATION OR EMPLOYING TACTICS TO DETECT BOTS.

PAYPAL COOPERATED WITH THE INVESTIGATION, AND SAID IN RESPONSE TO THE PROBE, KEEPING “A SECURE PLATFORM IS A TOP PRIORITY.”

THE COMPANY NOW REQUIRES ALL U-S CUSTOMERS TO USE MULTIFACTOR AUTHENTICATION, REQUIRED PASSWORD RESETS ON AFFECTED CUSTOMER ACCOUNTS, AND DEPLOYED PROTECTIONS TO DETECT BOTS, ACCORDING TO A CONSENT ORDER

FOR MORE ON THIS STORY– DOWNLOAD THE STRAIGHT ARROW NEWS APP OR VISIT SAN DOT COM.