# PayPal support operations breached via Transcom

Published: 2026-09-18 · Severity: routine · Sectors: financial-services
Canonical: https://vorant.io/reports/29041e0c-1e35-5560-850a-7df259a60ee5/paypal-support-operations-breached-via-transcom

> Transcom WorldWide, PayPal support contractor, compromised with 40 employees and 704 user accounts exposed.

Transcom WorldWide, a third-party contractor providing customer support operations for PayPal, has been compromised. The breach exposed credentials for 40 employees and 704 user accounts, along with 666 third-party employee credentials. The attacker obtained an external attack surface of 112 exposed resources and obtained DNS records for the victim's domain. The incident was indexed by ransomware.live, indicating the compromise is publicly disclosed by threat actors. This represents a supply-chain style breach affecting a critical payment-processor support function, potentially exposing customer data and authentication credentials that could be leveraged for lateral movement into PayPal systems or fraudulent activity.

1 detection for this report is in the app: the rules that match its indicators, the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. A new account gets three days of them free.

Source reporting: https://www.ransomware.live/id/UGF5UGFsIHN1cHBvcnQgb3BlcmF0aW9ucyAoVHJhbnNjb20gV29ybGRXaWRlKUBOMG4=

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/29041e0c-1e35-5560-850a-7df259a60ee5/paypal-support-operations-breached-via-transcom.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup