Paidwork Data Breach Reportedly Exposes 23 Million User Records, Including Financial Data

A significant data breach affecting the online microtask platform Paidwork has reportedly exposed the personal information of more than 23 million users. The leaked database, which surfaced publicly in July, includes names, contact details, financial records, and passwords, according to security researchers.

Paidwork, a platform that offers users small payments for completing online tasks such as surveys and watching advertisements, has stated it is investigating the reported breach with external security specialists. The company also indicated it is taking steps to protect affected accounts and notify users as appropriate.

Scope of the Breach

The data allegedly compromised extends beyond simple email addresses. Have I Been Pwned, a service that tracks data breaches, confirmed the incident and added it to its database on July 19, 2026. The platform found that the released files contained over 23 million unique email addresses. Beyond emails, the breach reportedly exposed names, phone numbers, physical addresses, and dates of birth. Information related to education levels, gender, profile photos, and personal interests may also have been accessed.

Of particular concern are the financial details reportedly included in the leak. Files allegedly contain bank account numbers, transaction histories, and payout records. Additionally, device information and IP addresses might have been compromised, potentially revealing how users connected to the service. Passwords were reportedly stored using bcrypt hashes, a method designed to make them harder to crack, though weak or predictable passwords could still be vulnerable.

Potential for Widespread Harm

Even users who earned minimal amounts through Paidwork could be at risk. The combination of personal details and financial information can be exploited for sophisticated phishing attacks and fraud. For instance, criminals could use a user's address to make a fake security warning appear more convincing, or reference a real payout before claiming a bank transfer failed. The practice of password reuse across multiple online services amplifies the danger; if a Paidwork password is cracked, attackers could attempt to use it to gain access to other accounts, such as email, which can then be used to reset passwords for even more sensitive services.

User Precautions and Recommendations

Security experts advise individuals who used Paidwork to take immediate steps to protect themselves. This includes changing passwords on the Paidwork account and any other platform where the same password was reused. Enabling two-factor authentication (2FA) on all important accounts, especially email and financial services, is also recommended. Users connected to financial institutions through Paidwork should contact their banks or payment providers to inquire about monitoring or account replacement. Freezing credit with major bureaus can help prevent the opening of new fraudulent accounts.

Individuals are also urged to be vigilant against personalized phishing attempts that may reference specific details from the breach. It is crucial to avoid clicking on suspicious links in unsolicited messages and to verify communications directly with companies through official channels. Using strong antivirus software and considering data removal services to reduce personal information available on people-search websites are additional protective measures.

Have I Been Pwned offers a tool on its website where users can check if their email address was included in the breach. However, the service notes that public search results may not display all exposed data, and it is advisable to take protective measures even if a search yields no match.