For incoming payments to Bitcoin companies the malleability attack can be a bit of a headache, depending on how things are implemented. It's mostly just a nuisance as wallet balances remain correct since your transaction do go through.

If you have a system that tracks transactions using e.g. it's TXID your system can easily get confused because of the malleability attack. I suspect this is the issue that BitPay is having.

When a user creates a transaction and broadcasts it, the receiving company's system finds it and starts to track it based on the TXID. However, the attacker conducting the malleability attack sends out a new transaction which is exactly the same except that the TXID is slightly modified. If it is this second transaction, that your system isn't tracking, is the one that gets confirmed by the blockchain it can have some consequences.

If the system is tracking the transaction using the original TXID it will show the transaction as being unconfirmed, since the original transaction is the one that was rejected by the Blockchain. To the system, the BTCs that come in to the wallet are a completely different transaction as the TXID is different than the expected transaction.

What ends up happening is the receiving wallet has the correct balance, but the tracking system is confused.