Was It Breached Secria

Recent breaches

Prosper data breach: what leaked, and where the lawsuit stands

Prosper, the personal loan company, says an outside criminal actor pulled customer and applicant data from its databases in 2025. Indiana's attorney general lists 13,076,476 people.1,2

Return Mail Processing
PO Box 999
Suwanee, GA 30024

December 9, 2025

Re: Notice of Data Breach

... We completed this process on November 26, 2025. We have determined that your data elements were obtained.

... two years of complimentary credit monitoring and identity restoration services through ... Experian. Ensure that you enroll by: March 31, 2026 (Your code will not work after this date.)

... please call the call center at 1-833-918-9464, from 8 a.m. to 8 p.m. CT Monday through Friday ...

  1. The return addressA mail processing box in Suwanee, Georgia, not Prosper's San Francisco office.3,2
  2. Your own list of what leakedBlank in the filed sample, filled in per person.3
  3. The deadline has passedEnrollment in the free Experian IdentityWorks membership closed on 31 March 2026.3
  4. The call centerThe same number is Experian's line for the offer, per the letter's Attachment A.3

Drawn from the sample letter Prosper Marketplace filed with California's attorney general. Checked 4 November 2026 against the sources.

The facts, as filed

"The company says" marks Prosper's own account. A listing here isn't a finding that the company was at fault.

What happened
The company says it discovered unauthorized activity on 1 September 2025, and that between June and August 2025 personal information was obtained through queries on databases that store customer and applicant data. It says it was not ransomware.2
People affected
13,076,476 people, 275,894 of them in Indiana, per Indiana's attorney general, as of 4 November 2026.1 Washington's list counts 249,848 Washingtonians, reported 9 December 2025.4
Email addresses
Have I Been Pwned lists 17,605,276 unique email addresses from the breach. That counts addresses, not people.5
What leaked
The company lists name, Social Security number, date of birth, bank account number, Prosper account number, other financial or credit application information, driver's license number, marriage or birth certificate, passport number, tax information and payment card number. Your letter says which apply to you.2,3
What did not
The company says it found no evidence of unauthorized access to customer accounts and funds, and isn't aware of any misuse of the data.2
Lawsuit
The cases are consolidated as In re Prosper Funding, LLC Data Breach Litigation, No. 3:25-cv-07947-CRB (N.D. Cal.). On 27 August 2026 the court stayed the case while the parties go to mediation.6 These are claims, not findings.

From database queries to a stayed lawsuit

The dates come from Prosper's notice, its filings and the court record.

  1. Prosper discovers unauthorized activity.2

  2. It finishes working out whose data was taken.3

  3. Emails and letters start going out.2

  4. Last day to enroll in the free monitoring.3

  5. The court stays the class action for mediation.6

What to do now

Match the steps to the data your letter or email lists. The full checklist covers every data type.

  1. Social Security number listed: freeze your credit.The free monitoring has closed, but a freeze is free, lasts until you lift it, and won't affect your credit score.7 Our credit freeze guide has the details.
  2. Tax information or SSN listed: get an IRS IP PIN.The six-digit PIN stops someone else filing a tax return with your Social Security number.8
  3. Bank account or card number listed: watch your statements.The letter asks you to review account statements and credit history for anything you don't recognize.3
  4. Lost the letter or email?Prosper says it can't give an activation code by phone but can send another copy of your notice.2

Questions people ask

Is the Prosper data breach email or letter real?

Prosper says it notified people by email or by letter from 9 December 2025.2 The sample it filed in California returns to Return Mail Processing, PO Box 999, Suwanee, GA 30024, and gives 1-833-918-9464.3 Compare yours with our letter check.

Is there a Prosper data breach settlement?

Not as of 4 November 2026. The court record shows the consolidated case stayed for mediation, which the parties expected in late 2026 or early 2027.6 A real claim process comes with a court-approved notice that names the case. This isn't legal advice.

Will Prosper pay for the monitoring I bought myself?

No. Prosper says it isn't compensating people for identity protection or credit monitoring bought outside its own offer.2

Has Prosper had a data breach before?

California's list holds an earlier Prosper Marketplace filing, for a breach dated 3 October 2018.9

Sources 9
  1. Data breach year-to-date report, 2025, Office of the Indiana Attorney General. Prosper Marketplace Inc, notice sent 9 December 2025. Read 4 November 2026.
  2. Cybersecurity Incident Customer FAQs, Prosper. Read 4 November 2026.
  3. Prosper Marketplace, Inc.: filing and sample notice (dated 9 December 2025), California Attorney General. Read 4 November 2026.
  4. Data Breach Notifications, Washington State Office of the Attorney General. Prosper Marketplace, Inc, reported 9 December 2025. Read 4 November 2026.
  5. Prosper breach entry (added 16 October 2025), Have I Been Pwned. Read 4 November 2026.
  6. In re Prosper Funding, LLC Data Breach Litigation, No. 3:25-cv-07947-CRB, stipulation and order to stay proceedings (Dkt. 110, filed 27 August 2026), U.S. District Court for the Northern District of California, via GovInfo. Read 4 November 2026.
  7. Credit freeze or fraud alert: Which is right for you?, Federal Trade Commission. Read 4 November 2026.
  8. Get an identity protection PIN (IP PIN) (reviewed 2 November 2026), Internal Revenue Service. Read 4 November 2026.
  9. Prosper Marketplace, Inc.: filing (breach dated 3 October 2018), California Attorney General. Read 4 November 2026.

Every breach is checked against the company's own notice and a government record, and every source shows the day we read it. How we check