PayPal has disclosed a data breach that leaked sensitive customer information for six months and led to a number of unauthrised transactions before it was discovered and fixed.