To the best of my knowledge, this was a straight-up Paypal hack.. the information was not phished from elsewhere to hack their specific account.
..only a few purchases from Gamestop showed up (from an unused debit card specifically entered for Paypal sales), and one trying to use a credit card (and info.) as collateral for a Lending-tree loan (..Mortgage specifically).
Fortunately Paypal was reasonably quick to respond, and refunded the Gamestop purchases. My parents have gone through the process of cancelling cards and getting things straight with Lending-tree. Annoying for them (particularly during the holiday season), but nothing terrible.
IF you've got a Paypal account, you might want to think about changing passwords and credit cards. Because I'm guessing it's a breech worthy of *multiple* account holders - with that information being sold. (..because I'm doubting the same person purchasing the games from Gamestop was trying to purchase a home.)