MyRecon OSINT
Paidwork
On 29 March 2026, Paidwork was breached. 23,272,765 accounts were exposed, including bank account numbers, dates of birth, device information. MyRecon rates it 75/100, severe. That is about 86% of the population of Australia.
Fourteen categories of data in one record, including bank account numbers, passwords and financial transactions, is close to the worst combination a single breach can produce. It is also an unsurprising one for a gig-economy platform: paying people requires banking details, verifying them requires identity data, and running the marketplace generates a behavioural record on top.
The four-month gap in this record is the part to sit with. Data was claimed and listed for sale in March; it was published in July. For anyone in the file, exposure began at the earlier date, every warning, every reset, every "we are investigating" statement in the interim was issued about data that was already in someone else's hands.
The order of response matters here more than usual. Bank details cannot be changed as easily as a password, so start by watching the account rather than trying to fix it: unexpected small transactions are the standard test before a larger one. Then kill the password everywhere it was reused. People who earn through platforms like this are also disproportionately targeted by "your payout failed" messages, which work because they arrive at a moment the recipient is genuinely expecting money.
The story behind the breach
In March 2026, hackers claimed they had obtained data from the gig economy platform Paidwork which they then listed for sale . Almost 11GB of data allegedly obtained from the platform was subsequently posted publicly in July and contained over 23M unique email addresses.
The breach also included a broad range of other data relating to the operation of the platform including user profile data, banking information, payout history for workers and passwords stored as bcrypt hashes.
Breach description from Have I Been Pwned, used under a CC BY 4.0 licence.
How did it happen?
The published account does not explain the exact way the data was obtained.
What was the motive?
In March 2026, hackers claimed they had obtained data from the gig economy platform Paidwork which they then listed for sale .
Reported demands or attempts to sell data describe what happened, rather than prove every attacker's intention.
What was the outcome?
23,272,765 accounts are listed in this breach. This is a count of accounts, not necessarily individual people.
The reported exposed data includes Bank account numbers, Dates of birth, Device information, Education levels, Email addresses, Financial transactions, Genders, IP addresses, Names, Passwords, Personal interests, Phone numbers, Physical addresses, Profile photos.
What was exposed, and why it matters
- Bank account numbersEnables direct-debit fraud and gives a caller the detail needed to sound like the bank.
- Dates of birthOne of the three things call centres ask to verify identity, and it never changes.
- Device informationFingerprints a device across services and helps an attacker imitate a trusted login.
- Education levelsAdds detail to a profile that can be assembled from several breaches at once.
- Email addressesThe address becomes a confirmed, active target, expect more phishing, better aimed.
- Financial transactionsAdds detail to a profile that can be assembled from several breaches at once.
- GendersSmall on its own; useful to anyone assembling a fuller profile.
- IP addressesApproximate location at the time of use, and a way to correlate accounts across services.
- NamesTurns an anonymous address into an identified person, which is what makes targeted phishing possible.
- PasswordsAnyone reusing this password elsewhere has those accounts exposed too, credential stuffing is automated and tries them all within days.
- Personal interestsAdds detail to a profile that can be assembled from several breaches at once.
- Phone numbersEnables SIM-swap attacks against SMS two-factor codes, and puts the number on scam-call lists indefinitely.
- Physical addressesWhere someone actually lives. Combined with a name this moves the risk off the internet.
- Profile photosAdds detail to a profile that can be assembled from several breaches at once.
What to do if you were in it
- Change this password anywhere you reused it, starting with your email account, that is the one that can reset all the others.
- Move two-factor authentication off SMS and onto an authenticator app, which a SIM swap cannot intercept.
- Check statements for the months after the breach date and ask your bank for a replacement card if the number was full.
- Be sceptical of post and callers who already know your address, knowing it is no longer evidence of anything.
- Expect better-aimed phishing. A message that already knows your name and where you have an account is the whole point of a breach like this.
Questions people ask about this breach
Was my email address in the Paidwork breach?
Use the email box on this page. The result applies only to this incident. If the provider does not cover this breach, we say so. A missing match does not prove you were unaffected.
What data was leaked in the Paidwork breach?
bank account numbers, dates of birth, device information, education levels, email addresses, financial transactions, genders, ip addresses, names, passwords, personal interests, phone numbers, physical addresses, profile photos. Each one is explained above, along with what it means for the person it belongs to.
When did it happen, and when did it become public?
The breach is dated 29 March 2026. It was published to Have I Been Pwned on 19 July 2026, a gap of 113 days during which the data was already out.
Is the Paidwork breach real?
Yes. Have I Been Pwned lists it as verified, meaning the data was checked against the source rather than taken on trust.
How many people were affected?
23,272,765 accounts. That is about 86% of the population of Australia. That is accounts rather than people, one person often has several.
Read next
Also in the archive
Case Files: how the landmark breaches actually happened →
Three kinds of content appear on this page and they are kept apart deliberately. The breach description is quoted from Have I Been Pwned under its licence. The severity score, the field-by-field explanation and the advice are computed from the record itself, every sentence derives from a number or a flag in it, which is what stops the analysis drifting from the evidence. Anything under the "MyRecon's take" byline is editorial: our reading of this breach, presented as opinion rather than as a finding.