Paypal confirmed fraudulent transactions (in other words a security breach) and refunds them, but denies to give details how many customers are affected or whether and how the hole has been closed.
https://www.spiegel.de/netzwelt/apps/paypal-sagt-nicht-wie-e... (in German)