Paidwork Breach Exposes Banking and Personal Data of More Than 23 Million Microtask Platform Users

Overview

A data breach at Paidwork, a platform that pays users small amounts to complete online microtasks, has exposed personal and financial information belonging to more than 23 million users, according to Help Net Security and Malwarebytes. Paidwork markets itself as a way to earn money through tasks such as watching ads, testing apps, and completing surveys, with most jobs paying only a few cents at a time, as Help Net Security reports.

What We Know

• According to Help Net Security, Have I Been Pwned added the breach to its database on July 19, and the leaked data covers 23,272,765 users, stemming from an intrusion that occurred in March 2026.
• The leaked database first surfaced in April, when an individual using the alias “hackformetome” advertised it on a cybercrime forum, claiming it was an 11GB dump pulled from Paidwork’s production systems containing records on more than 22 million users, according to Help Net Security. Malwarebytes similarly reports the intrusion took place in March 2026, with the stolen database first advertised on a cybercrime forum in April as an 11 GB dump allegedly taken from Paidwork’s production systems.
• The exposed data reportedly spans full names, email addresses, phone numbers, home addresses, dates of birth, gender, and education levels, along with bank account numbers and transaction records, according to both Help Net Security and Malwarebytes.
• The leak also reportedly includes device and IP information, profile photos, and personal interests, along with passwords stored as bcrypt hashes, per Help Net Security, which notes that while bcrypt is a much stronger hashing algorithm than most alternatives, it doesn’t make weak or commonly used passwords immune to cracking.
• “For cybercriminals, a dataset like this is a goldmine for targeted phishing, account takeover, and identity fraud,” Malwarebytes said.
• Paidwork has remained silent on the alleged breach, with no public acknowledgment issued, according to both Help Net Security and Malwarebytes.

What We Don’t Know

• Neither outlet reports how the attackers initially gained access to Paidwork’s systems, or which specific vulnerability, if any, was exploited.
• The exact number of records in the leaked dump remains disputed: the forum seller claimed more than 22 million records, while Have I Been Pwned’s processed count came to 23,272,765, and neither source explains the discrepancy.
• It is not known whether Paidwork has notified affected users directly or contacted regulators, since the company has not issued any public statement.

Guidance for Affected Users

Have I Been Pwned advises users who believe they may be affected to change their password immediately, not just on Paidwork but on any other account where the same password was reused, and to enable two-factor authentication where available, according to Help Net Security. Malwarebytes additionally recommends monitoring bank statements for unexpected withdrawals or suspicious activity and preparing for phishing emails, texts, and phone calls that could use the leaked information to appear more convincing.