MyRecon OSINTPaidwork
Behind the exposed accounts
In March 2026, hackers claimed they had obtained data from the gig economy platform Paidwork which they then listed for sale .
Follow the story
On 29 March 2026, Paidwork was breached. 23,272,765 accounts were exposed, including bank account numbers, dates of birth, device information. MyRecon rates it 75/100, severe. That is about 86% of the population of Australia.
How the story unfolded
Open a step to read the detail. Missing dates stay unknown.
02Entry point
The published account does not explain the exact way the data was obtained.
03Discovery and disclosure
A separate discovery or company-disclosure date is not established by this feed record.
04Added to the breach catalogue
2026-07-19. This is the catalogue date, not necessarily the disclosure date.
05Reported outcome
23,272,765 accounts are listed in this breach. This is a count of accounts, not necessarily individual people. The reported exposed data includes Bank account numbers, Dates of birth, Device information, Education levels, Email addresses, Financial transactions, Genders, IP addresses, Names, Passwords, Personal interests, Phone numbers, Physical addresses, Profile photos.
Fourteen categories of data in one record, including bank account numbers, passwords and financial transactions, is close to the worst combination a single breach can produce. It is also an unsurprising one for a gig-economy platform: paying people requires banking details, verifying them requires identity data, and running the marketplace generates a behavioural record on top.
The four-month gap in this record is the part to sit with. Data was claimed and listed for sale in March; it was published in July. For anyone in the file, exposure began at the earlier date, every warning, every reset, every "we are investigating" statement in the interim was issued about data that was already in someone else's hands.
The order of response matters here more than usual. Bank details cannot be changed as easily as a password, so start by watching the account rather than trying to fix it: unexpected small transactions are the standard test before a larger one. Then kill the password everywhere it was reused. People who earn through platforms like this are also disproportionately targeted by "your payout failed" messages, which work because they arrive at a moment the recipient is genuinely expecting money.
The story behind the breach
In March 2026, hackers claimed they had obtained data from the gig economy platform Paidwork which they then listed for sale . Almost 11GB of data allegedly obtained from the platform was subsequently posted publicly in July and contained over 23M unique email addresses.
The breach also included a broad range of other data relating to the operation of the platform including user profile data, banking information, payout history for workers and passwords stored as bcrypt hashes.
Breach description from Have I Been Pwned, used under a CC BY 4.0 licence.
How did it happen?
The published account does not explain the exact way the data was obtained.
What was the motive?
In March 2026, hackers claimed they had obtained data from the gig economy platform Paidwork which they then listed for sale .
Reported demands or attempts to sell data describe what happened, rather than prove every attacker's intention.
What was the outcome?
23,272,765 accounts are listed in this breach. This is a count of accounts, not necessarily individual people.
The reported exposed data includes Bank account numbers, Dates of birth, Device information, Education levels, Email addresses, Financial transactions, Genders, IP addresses, Names, Passwords, Personal interests, Phone numbers, Physical addresses, Profile photos.
What was exposed, and why it matters
Bank account numbers
Enables direct-debit fraud and gives a caller the detail needed to sound like the bank.
Dates of birth
One of the three things call centres ask to verify identity, and it never changes.
Device information
Fingerprints a device across services and helps an attacker imitate a trusted login.
Education levels
Adds detail to a profile that can be assembled from several breaches at once.
Email addresses
The address becomes a confirmed, active target, expect more phishing, better aimed.
Financial transactions
Adds detail to a profile that can be assembled from several breaches at once.
Genders
Small on its own; useful to anyone assembling a fuller profile.
IP addresses
Approximate location at the time of use, and a way to correlate accounts across services.
Names
Turns an anonymous address into an identified person, which is what makes targeted phishing possible.
Passwords
Anyone reusing this password elsewhere has those accounts exposed too, credential stuffing is automated and tries them all within days.
Personal interests
Adds detail to a profile that can be assembled from several breaches at once.
Phone numbers
Enables SIM-swap attacks against SMS two-factor codes, and puts the number on scam-call lists indefinitely.
Physical addresses
Where someone actually lives. Combined with a name this moves the risk off the internet.
Profile photos
Adds detail to a profile that can be assembled from several breaches at once.
What to do if you were in it
Questions people ask about this breach
Was my email address in the Paidwork breach?
Use the email box on this page. The result applies only to this incident. If the provider does not cover this breach, we say so. A missing match does not prove you were unaffected.
What data was leaked in the Paidwork breach?
bank account numbers, dates of birth, device information, education levels, email addresses, financial transactions, genders, ip addresses, names, passwords, personal interests, phone numbers, physical addresses, profile photos. Each one is explained above, along with what it means for the person it belongs to.
When did it happen, and when did it become public?
The breach is dated 29 March 2026. It was published to Have I Been Pwned on 19 July 2026, a gap of 113 days during which the data was already out.
Is the Paidwork breach real?
Yes. Have I Been Pwned lists it as verified, meaning the data was checked against the source rather than taken on trust.
How many people were affected?
23,272,765 accounts. That is about 86% of the population of Australia. That is accounts rather than people, one person often has several.
Read next
Also in the archive
Case Files: how the landmark breaches actually happened →
Three kinds of content appear on this page and they are kept apart deliberately. The breach description is quoted from Have I Been Pwned under its licence. The severity score, the field-by-field explanation and the advice are computed from the record itself, every sentence derives from a number or a flag in it, which is what stops the analysis drifting from the evidence. Anything under the "MyRecon's take" byline is editorial: our reading of this breach, presented as opinion rather than as a finding.