2026 Paidwork — HIBP 23,272,765 emails; gig-platform dump (Mar breach, Jul publish)
Data compromised
Emails, names, phones, addresses, DOB, banking/payout data, bcrypt hashes (per HIBP/CyberNews)
Technical writeup
HIBP-verified dump load — March 2026 intrusion window; public corpus ~11GB posted July 2026; Have I Been Pwned indexed 23,272,765 unique email addresses on July 19, 2026. Actor “hackformetome” advertised the dataset on a cybercrime forum around April 2026 claiming an 11GB production dump. HIBP and Help Net Security / CyberNews describe user profile data, banking information, worker payout history, and bcrypt password hashes among exposed fields. Paidwork had not issued a matching company confirmation at major trade-press indexing. BreachHistory indexes HIBP’s 23,272,765 email count as the attested dump size (company confirmation still pending).
Root cause
Unauthorized access / forum sale and public dump (company confirmation pending)
References
- https://haveibeenpwned.com/Breach/Paidwork
- https://cybernews.com/security/paidwork-data-breach-22-million-users/
- https://x.com/dailydarkweb/status/2078527237809131674
- https://www.helpnetsecurity.com/2026/07/20/paidwork-data-breach-23-million-users/
- https://www.theregister.com/cyber-crime/2026/07/20/infosec-expert-paidwork-users-data-pwned-after-23m-record-database-dumped-online/5274869