Paidwork data breach exposes personal and financial details of over 23 million users

In March 2026, attackers announced they had obtained a large dataset from Paidwork, a platform that pays users for completing small online tasks. Approximately 11 GB of the data appeared publicly in July, prompting the breach-tracking site Have I Been Pwned to add the incident to its database on July 19, where it counted more than 23 million distinct email addresses. The leaked files also contain users' names, phone numbers, physical addresses, dates of birth, education levels, gender, profile photos, personal interests, bank account numbers, transaction histories, device IPs and bcrypt-hashed passwords.

Paidwork confirmed it is working with outside security specialists to investigate and will inform users as needed. Security experts warn that the information could be used for credential-stuffing attacks, sophisticated phishing, and fraud, especially if victims reuse passwords or have linked bank accounts. Users are advised to change passwords, enable two-factor authentication and monitor financial accounts closely.