The Paidwork Data Breach: What Happened, What Was Leaked, and What to Do Now

On July 19, 2026, the microtask platform Paidwork was added to Have I Been Pwned (HIBP) after an 11 GB database containing records of 23,272,765 unique users was dumped publicly online . The data was allegedly stolen in March 2026 and was first offered for sale on a cybercrime forum before being released publicly in early July . This breach is especially severe because it exposed financial data that cannot be reset — unlike a password, a bank account number or date of birth remains permanently compromised .

What Information Was Leaked

The exposed database includes a broad range of personal and financial data :

• Personal identifiers: Full names, email addresses, phone numbers, home addresses, dates of birth, gender, education levels, and profile photos.
• Financial data: Bank account numbers, financial transaction history, payout records, and (for some users) PayPal details and cryptocurrency wallet addresses.
• Account credentials: Passwords hashed with bcrypt (a strong, slow hash), plus IP addresses and device information.
• Platform data: Personal interests and user profile details.

Troy Hunt noted that about 35% of the email addresses were already in HIBP from previous breaches, and that the bcrypt-hashed passwords — while not plaintext — are the only field that attackers can realistically attempt to crack offline .

Timeline: How the Data Was Stolen and Leaked

Date	Event
March 2026	Hackers claim to have obtained Paidwork's database and list it for sale on an underground forum
April 2, 2026	Threat actor "hackformetome" posts the alleged database (22M+ records, 11 GB) on a major dark web forum
May 26, 2026	The database is validated as a genuine production archive by breach monitoring services
Early July 2026	The dataset is made publicly available
July 19, 2026	HIBP adds the breach to its database; Mozilla Monitor also lists it

Risks to Affected Users

The combination of financial and personal data in a single dump creates a dangerous set of attack vectors:

• Financial fraud. Bank account numbers, PayPal info, and crypto wallet details are directly exposed, putting users at risk of unauthorized transactions, account takeovers, and targeted theft .
• Phishing and social engineering. With names, email addresses, phone numbers, home addresses, and transaction history all in one dataset, attackers can craft highly convincing phishing emails, SMS messages, or calls pretending to be Paidwork or a financial institution .
• Credential stuffing. Anyone who reused their Paidwork password on other sites is at risk of account takeover across those platforms. While bcrypt hashing makes bulk password cracking slow, weak or common passwords remain vulnerable .
• Identity theft. The combination of full name, DOB, address, phone, and financial data is sufficient for identity fraud in many jurisdictions .

7 Security Steps for Affected Users

If you had a Paidwork account, take these actions immediately:

1. Change your Paidwork password immediately — and change the same password on any other site where you reused it . Use a unique, strong password for every service.
2. Enable two-factor authentication (2FA) on your Paidwork account and any other accounts that support it. Prefer an authenticator app over SMS-based 2FA .
3. Monitor your financial accounts closely. Check bank accounts, PayPal, and cryptocurrency wallets for unauthorized transactions. Report any suspicious activity to your bank or payment provider immediately .
4. Watch for phishing attempts. Be extra suspicious of unsolicited emails, calls, or texts referencing Paidwork or your financial accounts. Do not click links in unexpected messages — navigate directly to the official website instead .
5. Check if your email was in the breach at haveibeenpwned.com .
6. Place a fraud alert or credit freeze with the major credit bureaus (Equifax, Experian, TransUnion) if you are in the U.S., especially since bank account numbers were exposed .
7. Run a doxxing exposure scan (e.g., DoxxScan) to map which of your handles, emails, and phone numbers are linked in the leaked data .

Bottom Line

The Paidwork breach is a stark reminder that gig-economy platforms hold a rich mix of personal and financial data that is highly valuable to attackers. Because many of the exposed data types — such as bank account numbers and dates of birth — cannot be changed, the risk of fraud and phishing will persist for years. Acting quickly to secure your accounts and monitor your finances is the best defense.