Data Breach Exposes 23 Million Paidwork User Records Including Banking Details

An online microtask platform that connects users with small-paying jobs has become the target of a significant data breach affecting over 23 million accounts. Paidwork, which allows users to earn money by completing surveys, testing applications and watching advertisements, disclosed that personal information belonging to its users has been compromised and made public.

Hackers first announced in March 2026 that they had obtained records from the platform, subsequently offering the stolen data for sale. By July 2026, nearly 11 gigabytes of allegedly stolen files appeared publicly, prompting the breach notification service Have I Been Pwned to analyze the released materials. The service identified more than 23 million unique email addresses in the leaked files and added the incident to its database on July 19, 2026.

The exposed information extends far beyond email addresses alone. The leaked files reportedly contain full names, phone numbers, physical addresses, dates of birth, education levels, gender information, profile photos and personal interests. Most concerning to security experts, the database includes bank account numbers, transaction histories, payout records, device information and internet protocol addresses.

Passwords stored as bcrypt hashes also appear in the breach, though this encryption method is more secure than weaker alternatives. Short or predictable passwords remain vulnerable to criminal attempts to crack them. Criminals can use this combination of personal and financial data to conduct targeted phishing attacks, commit identity theft or attempt fraudulent transactions.

A particular risk involves credential stuffing, whereby attackers use exposed Paidwork passwords to test the same login combinations on other websites and services. Email accounts present the highest priority risk, as compromised email addresses can be used to reset passwords on banking and other critical accounts.

Paidwork stated to security analysts that it is actively investigating the reported breach, collaborating with external security specialists and implementing protective measures for affected accounts. The company said it is notifying users as appropriate, though it has stated there is no confirmed evidence that its systems or user accounts were directly compromised.

Users who created accounts on the platform should immediately change passwords associated with their Paidwork profiles, even if they no longer use the service. Experts recommend creating entirely new passwords rather than modifying existing ones with minor variations, as criminals commonly test predictable password mutations.

Any password that was reused across multiple websites should be replaced on every account where it was used. Password managers can assist by generating and securely storing unique passwords for each service, with protection provided by a strong master password and multifactor authentication.

Two-factor authentication should be enabled on all available accounts, beginning with email and extending to banking, payment services and other critical financial accounts. An authenticator application or security key typically provides stronger protection than text message verification methods.

Individuals should contact their banks and payment service providers to inform them that their account information may have been included in the leaked database. Monitoring alerts for unauthorized withdrawals and transfers should be activated immediately, with close attention paid to any unrecognized transactions regardless of amount.

A credit freeze can prevent criminals from opening new accounts in a victim’s name and should be placed separately with Equifax, Experian and TransUnion. The process is free to implement and remove, and requires no evidence of actual identity theft to initiate. Credit freezes do not prevent fraud on existing accounts, making continued vigilance over current statements essential.

Users can check whether their email address appears in the breach by visiting the official Have I Been Pwned website at haveibeenpwned.com. Caution is warranted against entering passwords, Social Security numbers or banking information into any breach-checking tool, as criminals frequently create fraudulent versions of such services.

Phishing attempts related to the breach may arrive through email, text message or phone call, potentially referencing legitimate account details to establish credibility. Suspicious communications should be verified by opening the official application or typing the company’s website address directly into a web browser rather than clicking embedded links.

Data removal services can submit opt-out requests to people-search websites and data brokers that compile and sell personal information, though these services cannot eliminate records from criminal forums or government databases. The Federal Trade Commission notes that most people-search sites provide opt-out processes, with paid services available to handle requests on behalf of users.