MyRecon OSINT
Paidwork
On 29 March 2026, Paidwork was breached. 23,272,765 accounts were exposed, including bank account numbers, dates of birth, device information. MyRecon rates it 75/100 — severe. That is about 86% of the population of Australia.
What happened
In March 2026, hackers claimed they had obtained data from the gig economy platform Paidwork which they then listed for sale. Almost 11GB of data allegedly obtained from the platform was subsequently posted publicly in July and contained over 23M unique email addresses. The breach also included a broad range of other data relating to the operation of the platform including user profile data, banking information, payout history for workers and passwords stored as bcrypt hashes.
Breach description from Have I Been Pwned, used under a CC BY 4.0 licence.
Who was behind it
No party has been publicly confirmed as responsible, and this page will not name one. Most breaches are never formally attributed: data surfaces on a forum or inside a combined dump long after the intrusion, and the trail back to a specific actor is rarely made public. Where a group has claimed responsibility it is usually named in the account above — that claim is theirs, not a finding of ours.
What was exposed, and why it matters
- Bank account numbersEnables direct-debit fraud and gives a caller the detail needed to sound like the bank.
- Dates of birthOne of the three things call centres ask to verify identity, and it never changes.
- Device informationFingerprints a device across services and helps an attacker imitate a trusted login.
- Education levelsAdds detail to a profile that can be assembled from several breaches at once.
- Email addressesThe address becomes a confirmed, active target — expect more phishing, better aimed.
- Financial transactionsAdds detail to a profile that can be assembled from several breaches at once.
- GendersSmall on its own; useful to anyone assembling a fuller profile.
- IP addressesApproximate location at the time of use, and a way to correlate accounts across services.
- NamesTurns an anonymous address into an identified person, which is what makes targeted phishing possible.
- PasswordsAnyone reusing this password elsewhere has those accounts exposed too — credential stuffing is automated and tries them all within days.
- Personal interestsAdds detail to a profile that can be assembled from several breaches at once.
- Phone numbersEnables SIM-swap attacks against SMS two-factor codes, and puts the number on scam-call lists indefinitely.
- Physical addressesWhere someone actually lives. Combined with a name this moves the risk off the internet.
- Profile photosAdds detail to a profile that can be assembled from several breaches at once.
What to do if you were in it
- Change this password anywhere you reused it, starting with your email account — that is the one that can reset all the others.
- Move two-factor authentication off SMS and onto an authenticator app, which a SIM swap cannot intercept.
- Check statements for the months after the breach date and ask your bank for a replacement card if the number was full.
- Be sceptical of post and callers who already know your address — knowing it is no longer evidence of anything.
- Expect better-aimed phishing. A message that already knows your name and where you have an account is the whole point of a breach like this.
Questions people ask about this breach
Was my email address in the Paidwork breach?
Enter it in the box at the top of this page. MyRecon checks it against this breach and every other one on record, and the address is never stored.
What data was leaked in the Paidwork breach?
bank account numbers, dates of birth, device information, education levels, email addresses, financial transactions, genders, ip addresses, names, passwords, personal interests, phone numbers, physical addresses, profile photos. Each one is explained above, along with what it means for the person it belongs to.
When did it happen, and when did it become public?
The breach is dated 29 March 2026. It was published to Have I Been Pwned on 19 July 2026, a gap of 113 days during which the data was already out.
Is the Paidwork breach real?
Yes. Have I Been Pwned lists it as verified, meaning the data was checked against the source rather than taken on trust.
How many people were affected?
23,272,765 accounts. That is about 86% of the population of Australia. That is accounts rather than people — one person often has several.
Read next
Also in the archive
Severity is scored by MyRecon from the number of accounts, the sensitivity of the specific fields exposed, and whether the breach is confirmed — not by a language model. The description above is quoted from Have I Been Pwned; the analysis around it is ours.