Just to make sure you understand, this is a credential stuffing breach. You would have had to use a shared password on PayPal and a different compromised site. If this does apply to you, you really need to think about changing all your passwords and make sure they’re unique per site or at least unique for each high level of risk site. IE banking, financial, isp/cellular, medical, email high risk. Social media medium. Forums low risk. Etc..