My daughter's account was hacked. The hackers set up a business under her account and were in the process of transfering money from her bank account to one of the other account numbers they associated with the business. I can see how they might have been able to do this knowing only her PayPal password. But once inside could they have accessed her SSN?
I don't see how someone could set up a business business under a personal account without adding business information which would need to match the ID and address of the PayPal member. Any new linked accounts would also need to match the ID of the original account.
I think there is a lot of information missing about this case.
I share your concerns about what the hackers would have had to know. As to finding my SSN in my setting, all but the last two digits are redacted, which is encouraging. However you can download tax documents, which often contain unredacted SSNs. I don't have any tax documents to download, but I'm emailing that connection to my daughter as a possibly lead.
