Paidwork data breach
23,272,765 accounts exposed in a breach on 29 March 2026. Passwords were included.
At a glance
23,272,765
Accounts exposed
29 March 2026
Date of the breach
19 July 2026
Added to the list
What happened
In March 2026, hackers claimed they had obtained data from the gig economy platform Paidwork which they then listed for sale. Almost 11GB of data allegedly obtained from the platform was subsequently posted publicly in July and contained over 23M unique email addresses. The breach also included a broad range of other data relating to the operation of the platform including user profile data, banki
What was exposed
- Bank account numbers. Bank account numbers were exposed. Tell your bank and watch for payments you did not make.
- Dates of birth. Dates of birth were exposed. They help criminals prove they are you, and they cannot be changed.
- Device information. Details of your devices were exposed. They show what you use but cannot be used to log in.
- Education levels. Education levels were exposed. On its own it is low risk, but it adds to a profile of you.
- Email addresses. Email addresses were exposed. Expect more spam and phishing aimed at those addresses.
- Financial transactions. This kind of data was included in the breach. Treat it as exposed and be careful with messages that use it.
- Genders. Genders were exposed. On its own it is low risk, but it adds to a profile of you.
- IP addresses. Internet addresses were exposed. They show roughly where and how you connect. They cannot be used to log in.
- Names. Names were exposed. Scammers use real names to make a message look personal.
- Passwords. Passwords were exposed. Anyone who holds them can try them on other accounts, so treat any account that used the same password as at risk.
- Personal interests. This kind of data was included in the breach. Treat it as exposed and be careful with messages that use it.
- Phone numbers. Phone numbers were exposed. Expect scam calls and text messages, some of them pretending to be the organisation.
- Physical addresses. Home or postal addresses were exposed. They can be used to make a scam letter or a fake identity look real.
- Profile photos. This kind of data was included in the breach. Treat it as exposed and be careful with messages that use it.
What to do now
It depends on what was exposed, so these steps follow the list above.
If your password or sign-in details were exposed
- Change the password on the affected account now, and on every other account that used the same password.
- Use a password manager so each account has its own long, random password.
- Turn on two-step sign-in (multi-factor authentication) wherever it is offered, so a stolen password alone is not enough.
- If security questions were exposed, change them too, and treat the answers like passwords.
If payment details were exposed
- Check your bank and card statements for charges you do not recognise.
- Tell your bank. Ask about replacing the card or watching the account.
- Be wary of calls or messages that say they are from your bank and ask you to move money or read out a code.
If your contact details were exposed
- Expect more spam, scam calls and phishing. Do not click links or open attachments in messages you did not expect.
- If a message mentions this breach, do not reply. Go to the organisation's own website or app instead of using a link in the message.
Whatever was exposed
- Check which other breaches include your own email address and phone number.
- Keep an eye on your accounts for a few months. Breached data is often used long after the breach.
- If you think someone is using your details, report it to the organisation and to your national cyber crime reporting service.
Check your own exposure
- Password leak check: find out whether a password has appeared in a breach. The password never leaves your browser.
- Free domain security scan: grade the email, DNS and website security of a domain you own.
Related breaches
Other breaches that exposed some of the same kinds of data.
University of Nottingham
In June 2026, the University of Nottingham was the target of a cyber attack, later linked to a ShinyHunters "pay or leak" extortion campaign.
- Academic records
- Citizenship statuses
- Dates of birth
- Disabilities
- +11 more
Read what happened
Odido
In February 2026, Dutch telco Odido was the victim of a data breach and subsequent extortion attempt.
- Bank account numbers
- Customer service records
- Dates of birth
- Driver's licenses
- +7 more
Read what happened
Sharecare
In August 2026, the digital health company Sharecare was the target of a ShinyHunters "pay or leak" extortion campaign.
- Dates of birth
- Email addresses
- Employers
- Genders
- +6 more
Read what happened