The payments giant PayPal says a cybersecurity incident left highly sensitive customer information exposed for around six months.