A Global Security Response at Consumer Scale

01 · The situation

PayPal needed to run a major global security response that involved resetting passwords for 190 million users. A password reset sounds simple until you multiply it by the population of a large country. Every reset touches authentication systems, notification systems, and support channels at once.

02 · The constraint

The response had to happen at consumer scale, globally, on systems that people used to move money every second. Locking users out en masse would create a support and trust crisis of its own. The infrastructure had to absorb a synchronized surge in authentication traffic that normal capacity planning never anticipated.

03 · The decision

The engineering problem was making the reset flow a system that could survive its own success: capacity for the surge, throttling and sequencing so the wave did not become a self-inflicted outage, and monitoring granular enough to see trouble in minutes rather than hours. We engineered the supporting infrastructure so the response could proceed at pace without gambling on availability.

04 · What nearly broke

The dangerous failure mode in any mass-reset event is the feedback loop: users who fail to reset retry, retries amplify load, load causes failures, and failures cause more retries. Designing for that loop, rather than for the happy path, is what separates a controlled response from a second incident. The work was in the margins: queue depth, retry behavior, and knowing where the system would bend first.

05 · The result

The infrastructure supported the full response across 190 million password resets. The event stands as a reference point for what consumer-scale security operations demand: the security decision is the easy part, and the infrastructure that lets you execute it safely is the real work.