What to Do After the Prosper Data Breach

The Prosper data breach exposed personal information belonging to roughly 17.6 million borrowers and loan applicants, including Social Security numbers, bank account numbers, driver's license and passport numbers. The free Experian monitoring enrollment window closed on March 31, 2026, so if you applied to Prosper you now need to freeze your credit, lock your SSN, and shrink your exposed data footprint yourself.

What Happened

Prosper Marketplace, the San Francisco-based peer-to-peer lending platform, detected unauthorized access to its systems in early September 2025. Investigators concluded that an intruder had been running searches against databases holding customer and loan-applicant records between roughly June and August 2025 — months of quiet access before anyone noticed.

Prosper's count grew as the investigation continued, ultimately reaching approximately 17.6 million affected people. Notification letters began going out on December 9, 2025, and state attorneys general published breach notices through the following months. Have I Been Pwned added the incident to its database, listing 17.6 million compromised email addresses.

What Data Was Stolen

• Name, date of birth, and contact details
• Social Security number or national ID number
• Bank account numbers and Prosper account numbers
• Driver's license numbers and passport numbers
• Payment card numbers
• Tax information and other financial or credit application data
• Supporting identity documents in some cases, including marriage or birth certificate details

Prosper has said it found no evidence that attackers accessed customer accounts or funds, and that account passwords were not involved. That is cold comfort: with an SSN plus a government ID number, a fraudster does not need your Prosper login to open credit in your name.

Who Is Affected

Anyone who applied for a loan through Prosper, borrowed through the platform, or invested on it may be in scope — current customers and applicants whose loans were never funded alike. South Carolina alone flagged more than 236,000 affected residents, which gives a sense of the nationwide spread. Because the records go back through years of applications, many affected people no longer think of themselves as Prosper customers at all.

Step 1: Confirm Whether You Were Exposed

Check the email address you would have used on a loan application against Have I Been Pwned, which lists the Prosper breach. Then search your email archive and physical mail for a Prosper notification letter dated December 2025 or later — the letter states exactly which data elements were exposed for you, which is the detail that drives everything below. If you applied years ago and are unsure, assume exposure and proceed anyway; every step here is free and reversible.

Step 2: Freeze Your Credit at Every Bureau

A credit freeze is the single most effective response to an SSN exposure, it is free by law, and it does not affect your credit score. Freeze at all three major bureaus — Equifax, Experian, and TransUnion — and then do what most guides skip: freeze the secondary bureaus too, including Innovis, NCTUE, SageStream, and ChexSystems. Lenders and utilities that pull from those smaller bureaus are exactly where thin-file fraud slips through.

Step 3: Lock Your Social Security Number

Create a my Social Security account at ssa.gov to block anyone else from registering one in your name, and use E-Verify's Self Lock to stop your SSN from being used for employment verification. File IRS Form 14039 and request an IRS Identity Protection PIN so nobody can file a tax return under your number — tax-refund fraud is a common late-stage use of breached loan data.

Step 4: Watch Your Bank Accounts and Replace Exposed Numbers

Because bank account and card numbers were in scope, call your bank and ask them to flag the account, then consider having the account number reissued if it appeared in your notification letter. Set balance and transaction alerts at the lowest threshold your bank allows. Review statements line by line for small test charges — fraudsters validate stolen account details with trivial amounts before attempting anything large.

Step 5: Treat Your Driver's License and Passport Numbers as Compromised

Report the exposure to your state DMV and ask what their process is for flagging or reissuing a license number; several states will issue a new number when it has been used fraudulently. For passports, the State Department will not reissue over a breach alone, but you should report any suspected misuse immediately and stay alert to identity-verification requests you did not initiate.

Step 6: Expect Targeted Scams, Not Random Ones

Criminals holding a loan application know your income bracket, your lender, and your debt situation. Expect convincing calls and emails about "your Prosper loan", debt consolidation offers, or breach-settlement payouts. Rules that hold regardless of how legitimate the contact seems: no real institution asks for your full SSN, a password, or a one-time passcode by phone or email. Hang up and call back on a number you look up yourself.

Step 7: Shrink the Data Broker Trail That Makes Fraud Work

Stolen loan data becomes usable when it is combined with current address history, phone numbers, relatives' names, and employer details — the exact profile people-search sites publish about you for free. Removing those listings raises the cost of impersonating you and cuts off the verification answers a fraudster needs.

Frequently Asked Questions

How do I know if I was affected by the Prosper data breach?

Prosper mailed notification letters starting December 9, 2025 stating which data elements were exposed for you. You can also check your email address against Have I Been Pwned, which lists the breach's 17.6 million email addresses. If you applied for a Prosper loan at any point — funded or not — assume you were included.

How many people were affected by the Prosper breach?

Approximately 17.6 million people. The figure grew during the investigation as Prosper worked out how much of its customer and loan-applicant database the intruder had queried between June and August 2025.

Was my Social Security number stolen in the Prosper breach?

For many affected people, yes. Exposed data included Social Security numbers, dates of birth, bank account numbers, driver's license numbers, passport numbers, payment card numbers, and tax information. Your notification letter lists the specific elements involved in your case.

Can I still get the free credit monitoring Prosper offered?

No. Prosper offered two years of complimentary credit monitoring and identity restoration through Experian, but enrollment closed on March 31, 2026. Freezing your credit at all bureaus, locking your SSN with the SSA and E-Verify, and requesting an IRS Identity Protection PIN are free and arguably more protective than monitoring anyway.

Is there a Prosper data breach settlement or lawsuit?

Multiple law firms have been investigating and class-action complaints have been filed, but as of 2026 there is no approved settlement and no official claim form. Any email or text inviting you to claim a Prosper settlement payment should be treated as a phishing attempt until you verify it through a court-appointed administrator.

What should I do first if I was affected?

Freeze your credit at Equifax, Experian, TransUnion, and the secondary bureaus; create a my Social Security account and use E-Verify Self Lock; request an IRS Identity Protection PIN; and ask your bank to flag or reissue any exposed account number. Then reduce your public data footprint — PrivacyOn removes you from 100+ people-search sites and monitors the dark web so breached data is harder to turn into fraud.