Prosper data breach: Social Security numbers taken through database queries, and 1,161,581 Texans notified

Oregon's Department of Justice gives the first total: its breach list records 13,076,476 people for Prosper Marketplace, with a breach window from April 29 to September 2, 2025, discovery on September 1, 2025 and notice on December 9, 2025. Only DentaQuest's 15,000,000 is larger on Oregon's list for 2025 and 2026. The window means the intruder's access began about four months before Prosper found it.

How many people were affected by the Prosper data breach?

Prosper itself has not disclosed a total. The 13,076,476 figure is the one it gave the states: Indiana's attorney general records the same total in its 2025 report, with 275,894 Indiana residents, a notice sent on December 9, 2025 and a breach date of April 29, 2025, the same dates Oregon lists. It is the largest total in Indiana's 2025 report, which puts Prosper first in the largest data breaches of 2025. Its September 2025 8-K said it was still working out how many records were compromised and would notify people on a rolling basis. Its annual report for 2025 gives no count either. The one public number is Texas's: 1,161,581 Texans, posted on December 10, 2025. It covers Texas residents only.

Source	Who it counts	Number	Date
Oregon DOJ	All affected	13,076,476	Notice December 9, 2025
Texas attorney general	Texans	1,161,581	Posted December 10, 2025
Prosper SEC filings	All affected	Not disclosed	Through the 2025 10-K, filed March 26, 2026

The Texas record lists names, Social Security numbers, government-issued ID numbers, financial information such as account or card numbers, and dates of birth among the types involved.

What happened at Prosper?

Date	Event
September 1, 2025	Prosper identifies the unauthorized access
September 17, 2025	Form 8-K, Item 8.01
December 10, 2025	Texas posts its record (1,161,581 Texans)
March 26, 2026	Form 10-K: no material effect to date

Prosper says it started its cybersecurity response plans, investigated and contained the incident with outside experts, and told law enforcement. It filed under Item 8.01 rather than Item 1.05. In the 8-K it said it had not yet determined whether the incident was reasonably likely to have a material impact. The guide to Item 8.01 versus Item 1.05 explains the difference.

Were Prosper accounts or money affected?

No, according to Prosper. Both the 8-K and the 10-K say there is no evidence of unauthorized access to customer accounts and funds, and that customer-facing operations kept running. The risk for affected people is the personal data itself, chiefly Social Security numbers.

Was the Prosper breach material?

Not so far, by Prosper's account. The 10-K for 2025 says such incidents have not had a material effect on its business or operations to date. It also names a higher cost for its cybersecurity insurance as one of the risks that remain.

What Washington's attorney general recorded

Washington's attorney general lists a report from Prosper Marketplace, Inc, received on December 9, 2025, with 249,848 Washington residents affected and a breach date of April 29, 2025. For those residents the record lists names, Social Security numbers, financial and banking information and dates of birth as compromised. Washington's breach date falls four months before September 1, 2025, the day Prosper says it found the access; the record does not explain the difference.

What the filings leave open

• How many people were affected in total.
• How the third party got in.
• Whether applicants who never borrowed are among those affected, since the queried databases held applicant data too.