Paidwork breach puts 23.3 million user records in focus as banking data surfaces publicly
A dataset linked to microtask platform Paidwork containing records from 23.3 million accounts appeared publicly in July 2026, with breach-notification service Have I Been Pwned adding the incident to its index on July 19. The files reportedly carry bank account numbers, transaction histories, and bcrypt-hashed passwords alongside names, addresses, and phone numbers. Paidwork told CyberGuy it is actively investigating with external security specialists and says it has no confirmed evidence its systems or accounts were compromised.
Key takeaways
- A dataset linked to microtask platform Paidwork containing records from 23.3 million accounts appeared publicly in July 2026, and Have I Been Pwned added the incident to its index on July 19.
- The exposed files reportedly include bank account numbers, transaction histories, and bcrypt-hashed passwords alongside names, addresses, phone numbers, dates of birth, and other personal details.
- Paidwork says it is actively investigating with external security specialists and has no confirmed evidence its systems or accounts were compromised.
- Have I Been Pwned identified more than 23 million unique email addresses in nearly 11 GB of files that surfaced publicly in July after hackers claimed the data in March 2026.
- The combination of banking data and reused passwords creates risks of convincing fraud calls and credential stuffing across users' other accounts.
A dataset linked to microtask platform Paidwork containing records from 23.3 million accounts appeared publicly in July 2026, with breach-notification service Have I Been Pwned adding the incident to its index on July 19. The files reportedly carry bank account numbers, transaction histories, and bcrypt-hashed passwords alongside names, addresses, and phone numbers. Paidwork told CyberGuy it is actively investigating with external security specialists and says it has no confirmed evidence its systems or accounts were compromised.
What the files contain
Hackers claimed in March 2026 they had obtained data from Paidwork and later offered the material for sale. Nearly 11 GB of files then appeared publicly in July. Have I Been Pwned analyzed the released data and identified more than 23 million unique email addresses.
The exposed records extend well past login credentials. Have I Been Pwned says the files include full names, phone numbers, physical addresses, dates of birth, education levels, gender information, profile photos, and personal interests. Financial exposure looks more direct: bank account numbers, payout histories, and transaction records are reportedly present. Device identifiers and IP addresses round out the dataset.
Passwords were stored as bcrypt hashes, a method that raises the cost of cracking compared to weaker formats. Short or predictable passwords remain at risk regardless of the storage method used.
The setup for affected users
Paidwork is a microtask application that pays small amounts for completing surveys, testing apps, and watching advertisements. Earnings per task can be cents. The personal information collected to process those payouts carries a different weight.
Bank account numbers and transaction histories in the same dataset give criminals material for convincing fraud attempts. A caller who knows a user's Paidwork payout history can sound like a legitimate bank representative. Credential stuffing adds a second vector: a cracked bcrypt hash can be tested against email, banking, and payment accounts where users recycled the same password.
The email account sits at the center of the risk. Access to it opens password-reset flows across other services.
What to watch
Paidwork says it is working with external security specialists and will notify affected users as appropriate. The company has offered no confirmation of what systems were accessed or when the breach occurred. Have I Been Pwned's checker at haveibeenpwned.com lets users search whether their email address appears in the July 19 dataset. The search returns a match result but does not display the full record tied to each address.
Paidwork's own disclosure is the next confirmable milestone. No timeline for that has been provided.
Filed by the newsroom of MarketPR on August 1, 2026. Source: foxnews.com. Indicative figures are not investment advice.