Unauthorised activity affecting PayPal Working Capital accounts was disclosed in February 2026, with an exposure window described as running from 1 July to 12 December 2025 and unauthorised transactions reported.
A Lending Product Is Not A Payment Account
Working capital lending to small businesses is repaid from future sales, which means the platform holds trading history, revenue patterns and cash flow projections alongside the borrower’s identity.
That combination describes the financial health of a business in a way its own bank frequently cannot see, and it is commercially sensitive independent of any fraud risk.
Six Months Is The Number That Should Provoke Questions
Financial platforms are among the most heavily monitored systems in commercial technology, subject to transaction surveillance, anomaly detection and regulatory examination.
A window of that length in that environment suggests the activity resembled legitimate account usage closely enough not to trigger the controls — which is the recurring characteristic of every identity-led intrusion in this database, from 26-0714 onward.
Graded medium: the window and the disclosure are consistently reported, the affected population and the access route are not.
Compiled from public reporting, listed below. The affected population has not been disclosed and the access route is not established. Corrections: corrections@forensicpost.com.
- List of recent data breaches in 2026Bright Defense