According to a consent order, PayPal discovered the problem after a security analyst on Dec. 6, 2022 read an online message.