Millions Impacted in Two Major Financial Sector Data Breaches Two recent cybersecurity incidents at financial services providers have exposed the personal and financial data of nearly 19 million individuals, underscoring persistent vulnerabilities in the fintech and credit reporting sectors. ### Prosper Marketplace Breach Affects 13.1 Million San Francisco-based Prosper Marketplace, a peer-to-peer lending platform, confirmed on September 1, 2025, that unauthorized activity was detected on its systems. An investigation revealed attackers accessed sensitive data between June and August 2025, compromising records for 13.1 million individuals. Exposed information includes: - Names, Social Security numbers, and national ID numbers - Dates of birth, bank account details, and Prosper account numbers - Driver’s license numbers, passport data, tax information, and payment card numbers While Prosper stated there was no evidence of unauthorized access to customer funds, the breach has prompted notifications to affected individuals, along with two years of credit monitoring and identity restoration services via Experian. Law enforcement was notified, and additional security measures have been implemented. The breach disproportionately impacted certain states, with 1.1 million affected in Texas, 236,000 in South Carolina, and 249,000 in Washington. ### 700Credit Data Exposure Impacts 5.8 Million Michigan-based 700Credit, which provides credit reports and fraud detection services to U.S. car dealerships, disclosed a separate incident on October 25, 2025, after detecting unauthorized access to its systems. Attackers copied data belonging to 5,836,521 individuals, including: - Names, Social Security numbers, and dates of birth - Physical addresses 700Credit will file a consolidated breach notice with the FTC on behalf of affected dealerships, following agency approval. The company has also notified the FBI and will coordinate with state attorneys general. While dealers are relieved of FTC reporting obligations, they remain responsible for state-level breach notifications. ### Financial Sector Under Growing Threat These incidents follow a November 2025 cyberattack on SitusAMC, a mortgage servicing provider, further highlighting the financial sector’s appeal to cybercriminals. No threat actors have claimed responsibility for the Prosper or 700Credit breaches, but the scale of exposure raises concerns about identity theft and financial fraud. Both companies have advised affected individuals to monitor their credit reports for suspicious activity.

Prosper, a peer-to-peer lending marketplace, experienced a data breach on September 2nd due to unauthorized database queries by a hacker. The breach exposed highly sensitive customer and applicant data, including names, Social Security numbers, government-issued IDs, employment/credit status, income levels, birth dates, physical addresses, IP addresses, and browser user-agent details. While no customer accounts or funds were accessed, and operations remained uninterrupted, the stolen data—affecting 17.6 million unique email addresses—poses severe risks for phishing, identity theft, and fraud. Prosper is offering free credit monitoring to affected individuals, but the exposure of such comprehensive personal and financial information significantly elevates the threat of long-term exploitation by cybercriminals.

In September 2025, Prosper, a leading peer-to-peer lending platform, suffered a massive data breach exposing the personal information of 17 million users. Unauthorized actors gained access to sensitive data, including names, addresses, email addresses, Social Security numbers, and government-issued IDs, though no customer accounts or funds were directly compromised. The breach, described as sophisticated and stealthy, exploited vulnerabilities in Prosper’s backend systems, allowing attackers to exfiltrate data without disrupting operations.The incident has raised concerns over long-term risks like identity theft, phishing, and synthetic fraud, despite Prosper’s assurances that no account takeovers occurred. The company has initiated credit monitoring for victims and partnered with cybersecurity firms to strengthen defenses. However, the breach underscores systemic weaknesses in fintech security, prompting calls for regulatory oversight, zero-trust architectures, and stricter data governance. Legal repercussions, including potential class-action lawsuits, are underway, while the stolen data—particularly Social Security numbers—remains a high-value target for fraudsters. The event serves as a stark reminder of the fragility of trust in digital lending and the urgent need for proactive cybersecurity measures.

Prosper, a peer-to-peer (P2P) lending company, suffered a major cyberattack resulting in the exfiltration of highly sensitive personal data belonging to 17.6 million individuals. The breach exposed a vast trove of confidential records, including financial and personally identifiable information (PII), which could lead to severe consequences such as identity theft, financial fraud, and reputational damage. The scale of the breach—affecting millions of customers—highlights a critical failure in data security protocols, potentially eroding trust in the company’s ability to safeguard user data. The incident underscores the growing threat of large-scale data exfiltration by malicious actors targeting financial institutions. Given the nature of the stolen data, affected individuals face long-term risks, including unauthorized access to credit profiles, loan fraud, and targeted phishing campaigns. The breach also raises regulatory concerns, as Prosper may face legal penalties for failing to protect customer data under data protection laws like CCPA or GDPR (if applicable).

Prosper Marketplace, a peer-to-peer lending fintech platform, suffered a major data breach exposing 17.6 million unique email addresses and sensitive personal information of customers and prospective customers. The compromised data included names, dates of birth, physical/email addresses, Social Security numbers, credit status, employment details, and income information. While the company claims no unauthorized access to customer accounts or funds, the breach involved unauthorized database queries targeting proprietary and personal data. The incident was detected in mid-September, with the attack blocked by September 2, though the initial intrusion timeline remains undisclosed. Prosper, valued at nearly $20 billion after a $350 million funding round in April, has since enhanced security controls, including robust monitoring and alerting systems. The breach notification service Have I Been Pwned confirmed 2.8 million previously unexposed email addresses among the leaked data, highlighting the severity of the exposure.

Peer-to-peer lending platform Prosper suffered a cyberattack in September, exposing 17.6 million records (per HaveIBeenPwned). The breach compromised highly sensitive personal data, including email addresses, browser user agents, credit statuses, dates of birth, employment details, government-issued IDs, income levels, IP addresses, names, physical addresses, and Social Security numbers. While customer accounts and funds remained secure, the leak of SSNs and financial identifiers poses severe risks of identity theft, fraud, and long-term reputational harm. Prosper’s investigation remains ongoing, with no confirmed timeline for the intrusion’s start or full scope. The company has pledged free credit monitoring for victims and is cooperating with law enforcement. Given Prosper’s role in facilitating $28 billion+ in loans, the breach undermines trust in its data security practices, though operational disruptions were avoided. If validated, this would rank among 2024’s largest financial-sector breaches, though it falls short of historic incidents like Yahoo (3B) or JPMorgan Chase (83M).

The California Office of the Attorney General reported that Prosper Marketplace, Inc. experienced a data breach on October 3, 2018. The breach was reported on November 26, 2018. The breach involved the unauthorized access to personal information of customers, including names, addresses, dates of birth, Social Security numbers, and Prosper account numbers. The incident did not involve any financial information or login credentials. The company took immediate steps to secure the affected systems and notified all potentially impacted individuals.