A bug in the code of a PayPal app exposed PII for numerous people, and some even (briefly) lost their money.