Prosper, a San Francisco-based fintech company offering personal loans and consumer credit products, detected unauthorized access to its systems in September 2025. The breach exposed records tied to approximately 17.6 million unique email addresses, covering both existing customers and loan applicants. The method of intrusion has not been publicly disclosed. The exposed data includes names, dates of birth, home addresses, Social Security numbers, government-issued ID details, employment status, income levels, credit status, IP addresses, and browser information. Together, these fields form a complete financial and identity profile of the kind a lender collects during a loan application. For affected individuals, this combination creates serious risk of identity theft, fraudulent loan applications, and targeted scams that may reference personal financial details to appear credible. Prosper stated it found no evidence of unauthorized access to customer accounts or funds, and that its operations remained uninterrupted. As of early 2026, no confirmed class-action litigation or regulatory enforcement action specific to this breach had been widely documented. Despite the absence of confirmed misuse, anyone whose data was held by Prosper should monitor their credit reports closely, consider placing a credit freeze, and remain alert to unsolicited contact referencing their financial information.

Peer-to-peer lending platforms collect borrower and investor identity, credit-related data, bank-linkage records, income information, and transaction history across lending and servicing operations.

Prosper has continued operating as a consumer lending platform through a period of elevated interest rates that compressed margins across the fintech lending sector. The company has not made major organizational announcements in the 12-18 months prior to the breach beyond normal business operations.