How does Paypal store credit card numbers?
Have they published any information this?
As for now I would say that they encrypt the card numbers and store the key in an HSM, but this is just a personal guess.
This is most likely confidential, so I bet you won't get a 100% answer to this one. However, we know PayPal are PCI-DSS compliant.
This means they are compliant with 3.4 in the standard, which states: "Render PAN unreadable anywhere it is stored". That means with a probability of at least 99% that they store the credit card numbers encrypted. It is possible with compensating controls to store them unencrypted, but it's very difficult to get a compensation control to 3.4 approved by a QSA.
Regarding HSM, we must guess again. It is definitely possible to comply with PCI-DSS without using a HSM, it's just way harder. For a company with a small budget, they might want to avoid the cost purchasing a HSM. For a company like PayPal, it's a no-brainer, so I'm 99% sure they're using a HSM to manage their crypto keys.