Micro-task platform Paidwork is facing a serious data breach affecting millions of its users. Security research service Have I Been Pwned analyzed an 11 GB dataset that appeared online in July 2026 and found that 23.3 million unique email addresses had been exposed along with extensive personal and financial information.
The breach dates back to March 2026. Hackers claimed at the time to have infiltrated Paidwork's database and put the stolen information up for sale. The data then became publicly available in July. Have I Been Pwned added the dataset to its own database on July 19, 2026.
What data was compromised?
The leaked information is not limited to email addresses. According to Have I Been Pwned's report, the exposed dataset includes:
- First name, last name, phone number, physical address and date of birth
- Education level, gender, profile pictures and interests
- Bank account numbers, transaction records and payment history
- Device information and IP addresses
- User passwords encrypted with bcrypt algorithm
Banking details and password hashes, in particular, are among the critical data that attackers could use for phishing or identity theft attempts.
Company issues statement
In a statement to Fox News, Paidwork said it is actively investigating the breach allegations, is working with external cybersecurity experts, and has taken necessary steps to protect affected accounts. The company also announced it has begun notifying users.
Micro earnings, macro risks
Paidwork pays users small sums for completing micro-tasks such as filling out surveys, testing apps, or watching ads. But for an attacker, the real value lies in the personal and financial data behind those accounts. The leaked addresses and transaction records can be used to craft convincing phishing emails or phone scams. If the same password is used on other platforms, a single compromised account could lead to a chain of security breaches.
Security measures for users
Experts recommend that anyone who has used the platform take the following steps:
- Check your email address: Go to the Have I Been Pwned website and search for your email address. Even if no match is found, do not neglect the precautions.
- Change your password: Immediately change the password you used on Paidwork. If you used the same password on other platforms, update those as well.
- Use a password manager: Switch to a password manager that creates unique and strong passwords for each account.
- Enable two-factor authentication (2FA): Activate 2FA on every account where possible. Using an authentication app is safer for critical accounts.
- Contact your bank: If you linked a bank account to Paidwork, report the situation and set up alerts for transactions.
- Freeze your credit report: If you live in the US, you can initiate a free credit freeze via Equifax, Experian and TransUnion.
- Beware of personalized phishing attacks: Be cautious of suspicious emails, messages and calls that contain your personal information.
- Use a robust antivirus program: An up-to-date antivirus can detect malicious links and fake websites.
- Consider a data removal service: You can use services that help remove your personal information from people search sites.
Although Paidwork says it has not found conclusive evidence that its systems or accounts were breached, the findings from Have I Been Pwned and the existence of over 23 million email addresses make it necessary to take the warnings seriously.
