Digital Transactions Authoritative, insightful and timely information for payments professionals
PayPal Holdings Inc.’s planned integration of its TIO Networks bill-pay operation hit a major snag late Friday when PayPal said it had shut down TIO’s system after the discovery of a security issue. Neither PayPal nor TIO released details about the issue. In a statement, PayPal said it involves “security vulnerabilities on the TIO platform and issues with TIO’s data-security program that do not adhere to PayPal’s information-security standards.” On its home page, TIO released a statement on the matter, as well, with nearly identical language.
A PayPal spokesperson on Monday told Digital Transactions News no further information, including any indication of when the suspension might be lifted, is available.
The PayPal statement also hints that the payments company may now re-examine the deal under which it acquired TIO. PayPal paid $233 million for the Vancouver, British Columbia-based company in an agreement announced in February. The deal closed in July. PayPal said it has begun in internal investigation of the security issue and has also brought in outside cybersecurity experts to inspect TIO’s platform. “A focus of the investigation will also include TIO’s practices and representations prior to the acquisition,” the statement said.
PayPal said the issue does not affect its own platform and that users’ PayPal information “remains secure.”
PayPal discovered the problem during what the two companies referred to as “PayPal’s standard pre-integration testing process.” With its third-quarter release, PayPal began including financial results from TIO in its own quarterly results, but, as PayPal’s statement said, “TIO is not integrated into PayPal’s platform.”
TIO represents a key element of PayPal chief executive Dan Schulman’s plan to bring financial services to underbanked consumers. The company processes cash-based bill payments on behalf of 10,000 billers through a network of 900 kiosks and some 65,000 walk-in locations. Last year, it processed 60 million consumer payments worth $7 billion. At that rate, a single day’s suspension would block, on average, 164,000 transactions worth $19.2 million.
