No, this was a genuine paypal email, addressed to me by name, and confirmed by logging into my account (directly, not from an email link).

I have changed my security and deleted the credit card from my account now. The hacker must have been able to see my balance, because he left only $3 in the account. So that is all that is now at risk.