Data belonging to more than 23 million users has been exposed following a breach at Paidwork, a platform that pays people for completing online microtasks.
Paidwork markets itself as a way to earn money through simple tasks like watching ads, testing apps, and completing surveys, with most jobs paying only a few cents at a time. For its users, many of whom are drawn to the platform for small, incremental earnings, the fallout from this breach could end up costing far more than they ever made.
According to Have I Been Pwned, which added the breach to its database on July 19, the leaked data covers 23,272,765 users and stems from an intrusion that occurred in March 2026.
The leaked database reportedly first surfaced in April, when an individual using the alias “hackformetome” advertised it on a well-known cybercrime forum, claiming it was an 11GB dump pulled from Paidwork’s production systems and contained records on more than 22 million users.
The exposed data reportedly spans a wide range of categories, including users’ full names, email addresses, phone numbers, and home addresses, alongside more sensitive details such as dates of birth, gender, and education levels. Bank account numbers and transaction records were also among the data exposed.
On top of that, the leak reportedly includes device and IP information, profile photos, personal interests, and passwords stored as bcrypt hashes. While bcrypt is a much stronger hashing algorithm than most alternatives, it doesn’t make weak or commonly used passwords immune to cracking.
So far, Paidwork has remained silent on the alleged breach, with no public acknowledgment issued.
Have I Been Pwned advises users who believe they may be affected to change their password immediately, and not just on Paidwork, but on any other account where the same password was used.
They also advise enabling 2FA where available, as a further layer of protection against unauthorized access. Additionally, they recommend using a password manager, which can generate and store strong, unique passwords for each account.
