Paypal confirmed fraudulent transactions (in other words a security breach) and refunds them, but denies to give details how many customers are affected or whether and how the hole has been closed. https://www.spiegel.de/netzwelt/apps/paypal-sagt-nicht-wie-e... (in German)

Interesting. Sounds like a race to find the exploit, since it's mostly just German accounts being hacked now. I imagine the bug isn't limited to just German accounts.