Stolen data may include names, dates of birth, social security numbers, driver's license information, medical histories, lab results, and even prescription details. Essentially, it's everything you wouldn't want falling into the wrong hands.

WMH reports that approximately 163,440 people were affected. They have offered a year of free credit monitoring and identity theft protection, brought in cybersecurity experts, reset passwords, and implemented new detection tools. They also state there is no evidence that the stolen data has been used so far, but we all understand how these situations can develop.

Later, the Monti ransomware group posted WMH on their leak site, matching their record of exploiting vulnerabilities to gain entry. Notably, Monti seems to have gone silent since May 2025.

How do you feel about a year of credit monitoring, given that stolen data includes lifelong personal info like social security numbers and medical histories?

Now, here’s the messy part: the people who posted the leak aren’t just claiming to have emails and passwords; they’re also claiming to have related URLs. That kind of information makes automated credential-stuffing attacks significantly easier, and we all know where that usually leads: identity theft, drained accounts, and the like. They’re even bragging that thousands of the leaked passwords are strong and unique, though most are probably recycled across multiple accounts.

PayPal, of course, is pushing back. They’re blaming it on infostealer malware and old credential-stuffing dumps, not a fresh hole in their system. For context, in 2022, they were hit with a $2 million fine in New York due to a security compliance failure. That incident “only” exposed 35,000 accounts, though. What’s circulating now is supposedly close to 16 million, which is a significant increase.

Bottom line, regardless of who’s telling the truth, it’s probably a smart move to reset your PayPal password if you haven’t in a while. And if you’re the type who reuses logins, this might be the wake-up call to stop doing that once and for all.