Making a few extra dollars online should not put your bank details or identity at risk. Yet that is the concern for people who used Paidwork, an online earnings application.
A leaked database tied to the platform reportedly contains information from more than 23 million accounts. If you ever signed up, now is a good time to take the warning seriously.
CyberGuy Live: Missed “Sick of Spam?” Get the replay and checklist
Our free CyberGuy Live class “Sick of Spam?” has ended, but you can still watch the full replay and download our spam-stopping checklist. Kurt “CyberGuy” Knutsson walks you step by step through simple ways to reduce robocalls, spam texts, junk email and unwanted messages. You’ll also learn how to curb political texts, clean up your inbox and spot messages that could put your personal information at risk.
Get the free replay and checklist now at CyberGuyLive.com.
COULD THE 7-ELEVEN BREACH AFFECT YOU?
Paidwork is a microtask platform that offers small payments for completing online activities. Those jobs can include answering surveys, testing apps and watching advertisements. You complete tasks, build a balance and eventually request a payout. For many people, the account may feel low risk because the earnings are small. However, the information behind those payments can be far more valuable.
Hackers claimed in March 2026 that they had obtained data from Paidwork. They later offered the information for sale. Nearly 11 GB of data allegedly taken from the platform appeared publicly in July. The data breach notification service Have I Been Pwned analyzed the released files and found more than 23 million unique email addresses. The service added the incident to its database on July 19, 2026.
Paidwork told CyberGuy it is actively investigating the reported breach, working with external security specialists and taking steps to protect affected accounts and notify users as appropriate.
The exposed information appears to reach far beyond email addresses. Have I Been Pwned says the files contain names, phone numbers, physical addresses and dates of birth. They also reportedly include education levels, gender information, profile photos and personal interests.
The financial records raise additional concern. The files reportedly contain bank account numbers, transaction information and payout histories. Attackers may also have device information and IP addresses. Those details can reveal how you connected to the service and which equipment you used.
Finally, the leak reportedly contains passwords stored as bcrypt hashes. Bcrypt makes passwords harder to crack than weaker storage methods. However, short or predictable passwords can still face attacks. That is a huge amount of personal information to exchange for tasks that may pay only a few cents.
WHAT A SCAMMER SEES THE MOMENT THEY GOOGLE YOUR NAME
You may have earned very little through Paidwork. A criminal could still find plenty of value in your account. For example, a phishing email could mention a real payout before claiming that your bank transfer failed. Another message could include your address to make a fake security warning look convincing.
Criminals can combine several leaked details to build a believable story around you. Password reuse creates another danger. If attackers crack your Paidwork password, they can test it on other websites. This type of attack is called credential stuffing. It succeeds when people reuse one password across several accounts. Your email account should cause the greatest concern. Someone who gets inside may use it to reset passwords for other services.
Bank account numbers and transaction histories can also support convincing fraud attempts. A caller who knows your payment history may sound like a legitimate representative. Attackers do not care how much you earned. They care how much they can make from the information connected to you.
This leak should make all of us think carefully about the information we give side-income platforms. A task may pay only a few cents. Meanwhile, the service may request your legal name and bank account information before releasing your earnings.
It may also collect your birth date, home address or information about your device. That creates an uneven trade. Before joining an earning app, review what information it collects. Look for an explanation of why the company needs each detail.
Also, check whether you can delete your account after you stop using the platform. Find out whether you can remove old payout methods and profile information. Avoid completing optional profile fields that reveal extra details about your life. The company cannot lose information that you never provided. You should also think carefully before connecting your primary bank account to a service you plan to use only occasionally.
Have I Been Pwned lists the Paidwork incident as affecting 23.3 million accounts. You can search the email address you used for the platform through its breach-checking tool.
A match means your email address appears in the released files. However, the public search will not display every exposed detail connected to you. You should still secure your accounts when a search produces no match. Public breach databases may contain incomplete records.
Also, make sure you visit the real Have I Been Pwned website. Criminals often create fake breach-checking pages to collect more personal information. Never enter a password, Social Security number or banking information into a breach-search tool.
Start with your login credentials and financial accounts. Then reduce the amount of personal information criminals can find elsewhere.
To see if your email was affected, visit Have I Been Pwned at haveibeenpwned.com . It is the first and official source for this newly added dataset. Enter your email address to find out if your information appears in the Synthient leak. When done, come back here for Step 2.
Change the password connected to your Paidwork account, even if you no longer use the platform. Create a completely new password. Avoid adding a symbol or number to your old password because criminals often test common variations. Next, change that password on every other account where you reused it. Also, immediately replace an exposed password anywhere you used it.
A password manager can create and store a different password for each account. That limits the damage from one exposed login. You also avoid relying on short passwords that are easier to remember and crack. Protect the password manager with a strong master password. Then enable multifactor authentication for the password manager itself.
Enable two-factor authentication (2FA) anywhere the option appears. Start with your email account. Then protect your bank, payment services and other important accounts. An authenticator app or security key usually provides stronger protection than a text message. However, any second verification step can improve your security.
Contact any bank or payment service you connected to Paidwork. Explain that your account information may appear in a leaked database. Ask whether the institution recommends extra monitoring or a replacement account number. Next, turn on alerts for withdrawals and transfers. You should also receive a warning when someone changes your account information. Report any transaction that you do not recognize. Do not ignore a small charge because criminals sometimes use minor transactions to test an account.
A credit freeze can help stop someone from opening a new credit account in your name. You need to place the freeze separately with Equifax, Experian and TransUnion. A freeze costs nothing to place or remove. You do not need to wait for evidence of identity theft. The FTC says a credit freeze can help after your personal information appears in a data breach. Remember that a credit freeze cannot prevent fraud involving an account you already have. Continue watching your existing bank and credit card statements.
Be suspicious of emails, texts or calls that mention Paidwork, a payout or a bank transfer. A criminal may know your full name or address. That knowledge does not prove the message came from a legitimate company. Avoid clicking links in unexpected messages. Open the official app or type the company’s address into your browser instead. Never share a verification code with someone who contacts you. Criminals often request those codes while trying to enter your account. Phishing links can steal information or install malware on your device.
Strong antivirus software can warn you about malicious links, infected attachments and fake websites. This protection becomes especially useful after a breach. Criminals often send fake security alerts that pressure you to download a file or visit a login page. Keep your security software updated so it can recognize newer threats. However, antivirus protection cannot catch every convincing scam. Continue checking the sender and web address before clicking anything. The FTC recommends using security software to protect your devices from malware and other online threats. Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android and iOS devices at CyberGuy.com.
The Paidwork files reportedly contain information that may also appear on people-search websites. A data removal service can send opt-out requests to data brokers that collect and sell personal information. Reducing those records may make it harder for criminals to expand a leaked profile. You can also submit the removal requests yourself for free. However, you may need to contact many sites and repeat the process when your information returns. A data removal service cannot erase the Paidwork files from criminal forums. It also cannot remove government records or every old listing from the internet. The FTC says people-search sites usually provide an opt-out process. It also notes that paid services can complete requests on your behalf. Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting CyberGuy.com.
A platform may pay you a few cents while storing information that can affect your life for years. The Paidwork files reportedly combine personal profiles with banking information and password hashes. That gives criminals several ways to target you, even when your Paidwork balance was nearly empty. Paidwork says it has no confirmed evidence its systems or accounts were compromised. However, Have I Been Pwned found more than 23 million unique email addresses in the publicly released files. Treat the warning seriously if you ever used the platform. Change reused passwords first. Then secure your financial accounts and watch for messages that know a little too much about you.
How much personal information should a side-hustle platform be allowed to collect for a few dollars in return? Let us know by writing to us at Cyberguy.com
Sign up for my FREE CyberGuy Report
Copyright 2026 CyberGuy.com. All rights reserved.
