Most companies wouldn't even act on a credential stuffing attack against their users. They'd shrug and say 'not our problem if our users don't secure their passwords properly'.
Kudos to Paypal here for considering it a breach, and reporting it as such.
Kudos to Paypal here for considering it a breach, and reporting it as such.