Massive Data Breach Exposes 23 Million Paidwork Users’ Personal and Financial Information
A significant data breach has compromised the personal and financial details of over 23 million users of the microtask platform Paidwork, with the exposed database surfacing online earlier this month. The incident, first detected in March, was added to Troy Hunt’s Have I Been Pwned on July 19, confirming the leak of 23,272,765 records.
The breach came to light in April when a threat actor under the alias "HACKFORMETOME" advertised an 11 GB database on a cybercrime forum, claiming it contained records of 22+ million users. The seller attempted to auction the data via Telegram and Tox, though its authenticity was later verified by security researchers.
The exposed data extends far beyond basic contact information, including:
- Bank account numbers
- Phone numbers and physical addresses
- Dates of birth and profile photographs
- IP addresses and device details
- Financial transaction records and payout histories
- Education levels
- Passwords stored as bcrypt hashes (though weak passwords remain vulnerable to cracking)
Paidwork, which allows users to earn small payments for tasks like watching ads, completing surveys, and testing apps, has not publicly acknowledged the breach or responded to inquiries about its authenticity. Users typically need to accumulate at least $10 before cashing out, but the breach now exposes them to heightened risks of identity theft, phishing, and financial fraud.
The full scope of the incident remains unclear, as Paidwork has yet to issue an official statement or confirm remediation efforts.
Paidwork cybersecurity rating report: https://www.rankiteo.com/company/paidworkco
"id": "PAI1784551106",
"linkid": "paidworkco",
"type": "Breach",
"date": "3/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'customers_affected': '23,272,765',
'industry': 'Microtask Platform',
'name': 'Paidwork',
'type': 'Company'}],
'attack_vector': 'Unknown',
'data_breach': {'data_encryption': 'Partial (bcrypt hashes)',
'data_exfiltration': 'Yes',
'number_of_records_exposed': '23,272,765',
'personally_identifiable_information': 'Yes',
'sensitivity_of_data': 'High',
'type_of_data_compromised': ['Bank account numbers',
'Phone numbers',
'Physical addresses',
'Dates of birth',
'Profile photographs',
'IP addresses',
'Device details',
'Financial transaction records',
'Payout histories',
'Education levels',
'Passwords (bcrypt hashes)']},
'date_detected': '2024-03-01',
'date_publicly_disclosed': '2024-07-19',
'description': 'A significant data breach has compromised the personal and '
'financial details of over 23 million users of the microtask '
'platform Paidwork, with the exposed database surfacing online '
'earlier this month. The incident was first detected in March '
'and confirmed on Troy Hunt’s Have I Been Pwned on July 19, '
'revealing the leak of 23,272,765 records. The breach was '
'advertised by a threat actor in April, with the data '
'including bank account numbers, phone numbers, physical '
'addresses, dates of birth, profile photographs, IP addresses, '
'device details, financial transaction records, payout '
'histories, education levels, and passwords stored as bcrypt '
'hashes. Paidwork has not publicly acknowledged the breach or '
'responded to inquiries.',
'impact': {'brand_reputation_impact': 'High',
'data_compromised': '23,272,765 records',
'identity_theft_risk': 'High',
'payment_information_risk': 'High'},
'initial_access_broker': {'data_sold_on_dark_web': 'Yes'},
'investigation_status': 'Ongoing',
'motivation': 'Financial Gain',
'references': [{'date_accessed': '2024-07-19',
'source': 'Have I Been Pwned',
'url': 'https://haveibeenpwned.com'},
{'date_accessed': '2024-04-01', 'source': 'Cybercrime Forum'}],
'threat_actor': 'HACKFORMETOME',
'title': 'Massive Data Breach Exposes 23 Million Paidwork Users’ Personal and '
'Financial Information',
'type': 'Data Breach'}