2026 WorkL — forum database leak claim; ~29K users + org/device tables (unverified)
Data compromised
Advertised (unverified): ~29K user accounts plus org-user/device/company/profile tables — names, emails, phone numbers, company names, job titles, geolocation, device info, password hashes
Technical writeup
Unverified forum leak claim — August 18–20, 2026. DailyDarkWeb and BreachNews reported a threat-actor post claiming a WorkL.com (workplace intelligence / employee engagement) database leak. Actor framing includes roughly 29,000 user accounts plus larger related tables (BreachNews cites ~43K organization users, ~65K devices, ~150K survey company records, ~71K company records, ~392K user profiles). Alleged fields: names, emails, phone numbers, company names, job titles, geolocation, device details, and password hashes (samples described as hashed, not plaintext). DailyDarkWeb analyst note: visible samples contain 2022–2023 timestamps, so the Aug 18, 2026 compromise date should not be read as proof all records are recent. WorkL had not issued a public statement at indexing. recordsAffected 29000 = actor’s headline user-account figure (unverified).
Root cause
Unverified underground forum dump dated Aug 18, 2026; WorkL had not confirmed; DailyDarkWeb notes sample timestamps from 2022–2023