Prosper breach?

[crystal626]

Got an email tonight that I was involved in a breach with Prosper via a haveibeenpwned email address monitoring alert. The thing is, I don't remember ever having any business with this company. They seem to offer subprime credit cards. Anyone else get this email?

Breach: Prosper

Date of Breach: September 2025

Breached Accounts: 17.61 million

Compromised Data: Browser user agent details, Credit status information, Dates of birth, Email addresses, Employment statuses, Government issued IDs, Income levels, IP addresses, Names, Physical addresses

Description: In September 2025, Prosper announced that it had detected unauthorised access to their systems, which resulted in the exposure of customer and applicant information. The data breach impacted 17.6M unique email addresses, along with other customer information, including US Social Security numbers. Prosper advised that they did not find any evidence of unauthorised access to customer accounts and funds, and that their customer-facing operations were uninterrupted. Further information about the incident is contained in Prosper's FAQs.

[99BMWM3]

Yup, I too got an email letting me know I was pwned. 

$2.60 settlement cheques, here we come! 

[crystal626]

---

@99BMWM3 wrote:

Yup, I too got an email letting me know I was pwned. 

$2.60 settlement cheques, here we come! 

---

Did you have business with them? I'm wondering if maybe they merged with another company and that's how they got my info.

[Tdatb64]

Prosper likely got basic data on you from some broker or CreditKarma, etc. and then did a soft pull on one or more of your reports to see if you were someone they might be interested in extending credit to. This is how you get chosen for mailers or email offers by financial institutions you're not already doing business with. You may never have taken out a card or a loan with Prosper but that doesn't mean they don't have some of your personal info and, having that info, occassionally soft-pull your credit ('cause you know they never delete that info). This info won't be as detailed as it would be if you were a customer but it's still there for hackers and Prosper still has a responsibility to inform you if they suffer a breach.

[ptatohed]

If the sending email address appears fake, why treat this as anything but spam?

As an investor, I had peer to peer lending notes with Prosper for many years.  Did ok - averaged about 6-7% return.  I decided to turn off auto-invest some years ago, and just waited/waiting for the notes to be paid off.  I think I am down to less than $100 in notes owed me.  

[crystal626]

---

@ptatohed wrote:

If the sending email address appears fake, why treat this as anything but spam?

As an investor, I had peer to peer lending notes with Prosper for many years.  Did ok - averaged about 6-7% return.  I decided to turn off auto-invest some years ago, and just waited/waiting for the notes to be paid off.  I think I am down to less than $100 in notes owed me.  

---

haveibeenpwned is a legit breach tracking site. They've notified me of multiple breaches weeks before any other notice came elsewhere. They emailed me directly because my email address was in the breach. 

https://haveibeenpwned.com/

[crystal626]

---

@Tdatb64 wrote:

Prosper likely got basic data on you from some broker or CreditKarma, etc. and then did a soft pull on one or more of your reports to see if you were someone they might be interested in extending credit to. This is how you get chosen for mailers or email offers by financial institutions you're not already doing business with. You may never have taken out a card or a loan with Prosper but that doesn't mean they don't have some of your personal info and, having that info, occassionally soft-pull your credit ('cause you know they never delete that info). This info won't be as detailed as it would be if you were a customer but it's still there for hackers and Prosper still has a responsibility to inform you if they suffer a breach.

---

I suppose that could be how they got some of my info. The thing is, they have my email, and that should never be included in the basic info the credit bureaus give out.

[Tdatb64]

---

@crystal626 wrote:

---

@Tdatb64 wrote:

Prosper likely got basic data on you from some broker or CreditKarma, etc. and then did a soft pull on one or more of your reports to see if you were someone they might be interested in extending credit to. This is how you get chosen for mailers or email offers by financial institutions you're not already doing business with. You may never have taken out a card or a loan with Prosper but that doesn't mean they don't have some of your personal info and, having that info, occassionally soft-pull your credit ('cause you know they never delete that info). This info won't be as detailed as it would be if you were a customer but it's still there for hackers and Prosper still has a responsibility to inform you if they suffer a breach.

---

I suppose that could be how they got some of my info. The thing is, they have my email, and that should never be included in the basic info the credit bureaus give out.

---

Maybe not from the credit bureaus, (although they all share your info with their "partners" and you agree to it when you signup) but info brokers package together everything they can dig up and would've included your email in the package they sold to Prosper. I started getting emails from Prosper after I signed-up with CreditKarma and ran CK's loan offers tool.

[smcj]

---

@crystal626 wrote:

---

@ptatohed wrote:

If the sending email address appears fake, why treat this as anything but spam?

As an investor, I had peer to peer lending notes with Prosper for many years.  Did ok - averaged about 6-7% return.  I decided to turn off auto-invest some years ago, and just waited/waiting for the notes to be paid off.  I think I am down to less than $100 in notes owed me.  

---

haveibeenpwned is a legit breach tracking site. They've notified me of multiple breaches weeks before any other notice came elsewhere. They emailed me directly because my email address was in the breach. 

https://haveibeenpwned.com/

---

I was also notified by haveibeenpwned.  Been using them for years.  Good stuff.

Separately, anyone who has or had a Prosper account that will still log in to Prosper is greeted with a big fat stack of messaging about the breach.  Explanations, FAQ, the whole nine.  So at least according to Prosper itself, the breach is quite real.