PayPal will pay a US$2 million civil fine due to a cybersecurity incident in late 2022 that exposed customers’ personal information, including Social Security numbers.

The New York Department of Financial Services announced the penalty after an investigation found that PayPal failed to implement essential cybersecurity measures.

Since the incident, PayPal has taken steps to improve security, including requiring multifactor authentication for all US customer accounts.

NYDFS emphasized that these security measures were not in place during the breach, marking it as a violation of its cybersecurity regulations established in 2017.