California-based microtask platform Paidwork LLC is facing a legal investigation after an 11 GB database attributed to its production systems was dumped publicly in July 2026. Have I Been Pwned, which loaded the corpus on July 19, counts 23,272,765 unique email addresses tied to names, physical addresses, dates of birth, bank account numbers and payout histories. Record counts differ by source: the forum seller originally advertised "more than 22 million" users (The Register, Help Net Security, SecurityWeek), while HIBP's own analysis of the leaked file put it at 23.3 million; TechNadu prints the figure as "23,272,76," an apparent truncation of the HIBP number. Paidwork itself has not confirmed a breach. In a statement to SecurityWeek, the company said it has "no confirmed evidence that our systems or user accounts were compromised."
What Happened
The timeline across sources is broadly consistent, with one wrinkle. HIBP dates the underlying intrusion to March 2026. The Register and Help Net Security both report that the database first surfaced in April, when an actor using the handle "HACKFORMETOME" (rendered lowercase by Help Net Security) advertised an 11 GB dump from Paidwork's production systems on a well-known cybercrime forum, brokering the sale through Telegram and Tox. Two OTHER-tier outlets compress that window: CyberSecurityNews says the data was listed for sale in March, and TechNadu states the data was obtained and sold on March 23, 2026. Treat April as the better-sourced date for the public listing and March as the intrusion window.
The dataset moved from paid to free in July. Schubert Jonckheer & Kolbe, the San Francisco firm now investigating on behalf of users, dates the public leak to "on or around July 18, 2026." HIBP added the entry on July 19, and CyberSecurityNews credits the account Dark Web Intelligence on X with flagging the free release.
Accounts diverge on the company's posture. The Register, Help Net Security and Malwarebytes all reported that Paidwork had made no public acknowledgment. SecurityWeek later obtained a statement in which Paidwork said it was aware of the HIBP report, had no confirmed evidence of compromise, and had escalated the matter to its security team. Weighted as the victim's own words, that statement is the most authoritative account of Paidwork's position, and it stops well short of confirming the incident. The law firm's investigation rests partly on the gap itself: it argues that a March breach with no individual notification by August may violate state and federal notification law.
What Was Taken
HIBP's field inventory, echoed with minor variation across The Register, Help Net Security, SecurityWeek, CyberSecurityNews and TechNadu, covers:
- Full names, email addresses, phone numbers and physical addresses
- Dates of birth, gender and education level
- Bank account numbers, financial transaction records and gig-worker payout histories
- IP addresses and device information
- Profile photographs and stated personal interests
- Passwords stored as bcrypt hashes
Two things make this heavier than a typical credential dump. First, bank account numbers and payout histories sit alongside full identity attributes in the same records, which is enough for direct financial abuse rather than just resale. Second, the demographic and behavioral fields, education level and interests among them, give social engineers ready-made pretexts. On passwords, every source agrees bcrypt was used and every source qualifies it the same way: bcrypt materially raises cracking cost but does not protect weak or common passwords against a determined GPU rig.
Why It Matters
The victim population is the point. Paidwork pays users cents per task for watching ads, testing apps and completing surveys, and Help Net Security notes the obvious asymmetry: the fallout may cost users far more than they ever earned. Malwarebytes makes the same argument from the attacker's side, that criminals do not care how small your payout was, only how much your identity is worth. Users who signed up with a throwaway email and a reused password made a rational trade against a perceived low-value target, and the bank details attached to their payout method are what broke that assumption.
For defenders, the structural lesson is that payout infrastructure turns a low-trust consumer product into a financial-data custodian. Any platform that disburses money to users holds banking identifiers and transaction ledgers regardless of how trivial the per-transaction amounts are, and inherits the blast radius that comes with them.
The dispute between HIBP's verified corpus and Paidwork's "no confirmed evidence" statement is itself worth watching. Third-party breach verification increasingly outruns victim disclosure, and the notification gap is now the legal exposure, as the Schubert Jonckheer & Kolbe filing makes explicit. SecurityWeek also situates Paidwork alongside the separate Suno incident, in which HIBP identified 55.3 million unique addresses from a November 2025 intrusion, as part of a run of very large consumer-platform dumps landing in the same window.
The Attack Technique
No source identifies an initial access vector. There is no reported vulnerability, no phishing chain, no credential-stuffing origin and no ransomware component. What is known is limited to the actor handle HACKFORMETOME, the claim that the dump came from production systems, the 11 GB archive size, the March intrusion window per HIBP, and the sale attempt via a cybercrime forum with Telegram and Tox as contact channels. That progression, quiet intrusion to private auction to free public release roughly four months later, is the standard lifecycle for a database that failed to find a buyer at the asking price.
Because Paidwork has not confirmed the incident, there is also no vendor-supplied root cause analysis, no indicator set and no patch guidance to act on. Anyone claiming to know how the attackers got in is going beyond what the reporting supports.
What Organizations Should Do
- Treat leaked bcrypt hashes as compromised credentials, not protected ones. Force a reset for any user whose email appears in the corpus, and check your own login telemetry for credential stuffing sourced from Paidwork addresses. HIBP's guidance is to change the password everywhere it was reused, not just on Paidwork.
- Inventory where you store payout banking data. If your platform disburses funds to users, audit whether full account numbers need to be retained after a transaction settles, or whether a tokenized reference from your payment processor is sufficient.
- Segment production databases from application access paths. The dump was advertised as a full production extract. Query-level limits, egress monitoring on database hosts and alerting on bulk reads are what turn a foothold into a partial loss rather than a complete one.
- Rehearse the notification decision in advance. The legal exposure here stems from the four-month gap between intrusion and any user-facing notice. Know your state and federal clocks, and know who is authorized to start them when a third party publishes evidence before your own investigation concludes.
- Advise affected users on concrete steps. Enable two-factor authentication on email and banking accounts, freeze credit at all three bureaus, and monitor bank statements for unauthorized transactions, per PrivacyOn's guidance. Users should also review connected payment methods and the email address on file for changes they did not make.
- Add this corpus to your fraud models. The combination of verified address, date of birth, phone number and bank account makes these records unusually effective for account recovery abuse and voice phishing against financial institutions.
Sources: PRIVACY ALERT: Paidwork Under Investigation for Data Breach of Over... | Infosec expert: Paidwork users' data pwned after 23M-record databas... | Paidwork breach exposes sensitive data of 23 million user - Help Ne... | Suno, Paidwork Data Breaches Affect Tens of Millions of Accounts -... | Paidwork breach exposes data of 23 million users: Check if you're a... | Paidwork Data Breach Exposes 23 Million Users Banking and Personal... | Paidwork Data Breach: 23M+ Emails and Financial Data Exposed - Tech... | Paidwork Breach: What to Do After 23M Users Exposed (2026) PrivacyOn