Reported Paidwork Data Breach Exposes Banking and Personal Data From 23 Million Accounts

A database allegedly stolen from Paidwork has exposed personal, financial and account information connected to more than 23 million users. The leaked records reportedly include bank account numbers, financial transactions, contact details, payout histories and passwords stored as bcrypt hashes.

The Paidwork breach entry on Have I Been Pwned lists 23,272,765 compromised accounts. Hackers claimed in March 2026 that they had obtained the data and offered it for sale. An archive of almost 11GB was later posted publicly in July.

Paidwork provides an online platform where users can earn money by completing games, surveys, videos and other digital tasks. Its official terms of service say users can withdraw earnings through bank transfers or PayPal, which explains why the platform holds payment and payout information.

Paidwork has not publicly confirmed the incident

The available breach details come from the leaked database, cybercrime forum activity and Have I Been Pwned’s analysis. Paidwork has not published a public security notice confirming the incident, identifying its cause or explaining which systems attackers allegedly accessed.

A July 20 report on the Paidwork leak said the company had not issued a public acknowledgment. No official password-reset requirement or individualized notification process had been announced at that point.

The lack of a company statement leaves important questions unanswered, including when unauthorized access began, whether attackers still have access and whether Paidwork has secured the affected systems.

Known detail	Current information
Reported breach period	March 2026
Public leak	July 2026
Affected accounts	23,272,765
Archive size	Almost 11GB
Password format	Bcrypt hashes
Attack method	Not publicly disclosed
Paidwork response	No public breach acknowledgment identified as of July 20

What data was exposed in the Paidwork breach?

The leaked material reportedly contains much more than email addresses and account credentials. It combines identity information with payment records, profile data and technical details about users’ devices and internet connections.

According to the Have I Been Pwned breach record, the compromised data includes:

• Bank account numbers
• Dates of birth
• Device information
• Education levels
• Email addresses
• Financial transaction records
• Genders
• IP addresses
• Names
• Passwords stored as bcrypt hashes
• Personal interests
• Phone numbers
• Physical addresses
• Profile photos
• Worker payout histories

Not every affected account necessarily contained every type of information. Data fields often vary according to how fully a user completed a profile, which payout method they selected and how they used the platform.

Why the leaked banking and payout data matters

Bank account numbers and transaction histories can help criminals create convincing financial scams. An attacker could impersonate Paidwork, a bank or a payment provider while referring to real profile information or previous payouts.

Paidwork’s withdrawal policy states that payouts can involve bank transfers and PayPal. Users should therefore watch both their bank accounts and connected payment services for unexpected changes, unfamiliar transactions or messages requesting updated payout details.

A leaked bank account number does not automatically give someone access to the account. The level of risk depends on the country, banking system and additional information available to the attacker. Users should contact their financial institution if they notice suspicious activity or receive an unexpected request to change payment information.

Exposed information	Potential misuse
Email address and phone number	Phishing, scam calls and credential-stuffing attempts
Name, birth date and address	Identity impersonation and account-recovery fraud
Bank and payout details	Targeted payment scams and fraudulent financial requests
Password hash	Offline password-guessing attacks
Profile and interest data	Highly personalized social-engineering messages
Device and IP information	More convincing account-security impersonation

Bcrypt hashes still create password risks

Paidwork passwords reportedly appeared as bcrypt hashes rather than readable plaintext. Bcrypt deliberately makes each password guess computationally expensive, which gives it stronger resistance to cracking than fast, outdated hashing methods.

Hashing does not make weak passwords safe. Attackers who possess the database can test likely passwords offline without sending login requests to Paidwork. Short, common or previously leaked passwords face the greatest risk.

Password reuse increases the danger. If an attacker recovers a Paidwork password, they can try the same email and password combination against other services. This technique, known as credential stuffing, can affect email, social media, shopping and financial accounts.

The personal data could fuel targeted phishing

The combination of names, contact details, interests, addresses and payout histories gives criminals enough context to create messages that appear legitimate. A scam email could mention a real payment, profile detail or bank name before asking the recipient to sign in through a fake website.

CISA’s phishing guidance recommends treating urgent messages, unexpected links and requests for personal or financial information with caution. Users should open Paidwork or banking services directly rather than signing in through links in emails or text messages.

Device models and IP addresses do not normally provide direct account access. However, criminals could reference that information in fake security alerts to make an account-warning message sound credible.

What affected Paidwork users should do now

Anyone who created a Paidwork account should assume their data may have appeared in the leak until they check the affected email address. Users should change reused passwords immediately rather than waiting for a notification from Paidwork.

1. Change the Paidwork password to a strong, unique password.
2. Change the password on every other account where the same or a similar password was used.
3. Enable multifactor authentication on email, banking and payment accounts that support it.
4. Review recent Paidwork payouts, bank statements and PayPal activity.
5. Contact the relevant bank if unfamiliar transfers, direct debits or account changes appear.
6. Ignore unexpected messages asking users to confirm payout or banking information.
7. Review account-recovery email addresses, phone numbers and active sessions.
8. Save copies of suspicious messages and report attempted fraud.

CISA explains that multifactor authentication can prevent account access even when an attacker has obtained a password. Authentication apps, hardware security keys and passkeys generally provide stronger protection than verification codes delivered through text messages.

Users should prioritize their email accounts because email often controls password resets for other services. A unique email password and multifactor authentication can prevent a recovered Paidwork credential from becoming a wider account takeover.

How to check whether your email appeared in the leak

Users can enter an email address into Have I Been Pwned to check whether it appears in the Paidwork dataset or another known breach. The service does not require users to submit their password.

A matching result confirms that the email address appeared in the dataset, but it does not reveal exactly which other fields belonged to that account. Users should still take precautions because the leaked archive contains different combinations of personal and financial data.

No result does not guarantee that an account escaped every security incident. Breach-checking services can only search datasets they have received and processed.

Users should expect scams that impersonate Paidwork

Attackers often exploit public breach reports by sending fake password-reset notices, compensation offers or payment warnings. These messages may arrive even if the sender did not obtain data from the original incident.

The safest response follows CISA’s recommendations for suspicious messages: do not click unexpected links, do not download attachments and verify the request through an official website or known support channel.

Users should distrust anyone who asks for a password, authentication code, card PIN or remote access to a device. A legitimate support representative should not need those details to investigate whether an account was affected.

Paidwork still needs to explain the breach

Paidwork has not disclosed how the alleged intrusion occurred or whether it has completed a forensic investigation. It also has not publicly explained whether it invalidated passwords, rotated access credentials or notified affected users.

The continued absence of a public response, also noted in reporting on the 23 million exposed accounts, makes it harder for users to understand their individual risk.

Users should act on the information already available. Changing reused passwords, securing email accounts, monitoring financial activity and questioning unexpected payout messages can reduce the most immediate risks from the reported leak.

Adding multifactor authentication to important accounts provides another barrier if criminals recover a password from the bcrypt hashes or obtain credentials through phishing.

FAQ