Prosper, the popular peer-to-peer lending platform that connects borrowers with investors, suffered a major data breach on September 2nd. According to details shared on the company’s official FAQ page, the incident was caused by “unauthorized queries made on company databases that store customer and applicant data,” which allowed attackers to gain access to sensitive personal information.

The compromised data reportedly includes names, Social Security numbers, government-issued IDs, employment and credit details, income levels, birth dates, home addresses, IP addresses, and browser user-agent information. However, Prosper confirmed that no customer accounts or funds were accessed, and the company’s operations remained unaffected.

While Prosper has not revealed the total number of affected users, cybersecurity outlet BleepingComputer reported that as many as 17.6 million unique email addresses were involved in the breach.

This stolen data presents a serious risk of phishing scams and identity theft, as cybercriminals could use it to impersonate victims or gain unauthorized access to financial accounts. Prosper is currently offering free credit monitoring to affected users and encourages both current and former customers to reach out for further details on what specific information was exposed.

Experts recommend that affected users immediately update passwords for their Prosper account and any connected financial platforms. Choosing strong, unique passwords for each account—and using a password manager to store them securely—is strongly advised.

Additionally, users should enable two-factor or multi-factor authentication wherever possible, as it provides an essential layer of defense against unauthorized access. Remain cautious of phishing attempts, particularly emails or texts requesting personal information or prompting unexpected downloads.

Finally, individuals concerned about potential misuse of their data should consider enrolling in identity theft monitoring services. These tools can alert you to suspicious activity related to your Social Security number, financial accounts, or other sensitive personal details.