Full Report
In March 2026, hackers claimed they had obtained data from the gig economy platform Paidwork which they then listed for sale. Almost 11GB of data allegedly obtained from the platform was subsequently posted publicly in July and contained over 23M unique email addresses. The breach also included a broad range of other data relating to the operation of the platform including user profile data, banking information, payout history for workers and passwords stored as bcrypt hashes.
Analysis Summary
# Incident Report: Paidwork Data Breach
## Executive Summary
In March 2026, the gig economy platform Paidwork suffered a major data breach involving the exfiltration of approximately 11GB of internal data. The incident resulted in the exposure of over 23 million unique user accounts and sensitive operational data, which was subsequently leaked for free on the dark web in July 2026. The compromise includes highly sensitive PII, financial details, and hashed credentials.
## Incident Details
- **Discovery Date:** March 2026 (via threat actor sale claims)
- **Incident Date:** Circa March 2026
- **Affected Organization:** Paidwork
- **Sector:** Gig Economy / Freelance Technology
- **Geography:** Global
## Timeline of Events
### Initial Access
- **Date/Time:** Pre-March 2026
- **Vector:** Not explicitly disclosed
- **Details:** Threat actors gained access to Paidwork’s backend databases or storage environment prior to listing the data for sale.
### Lateral Movement
- **Details:** The breadth of the data (from user profiles to banking and payout history) suggests the attackers moved across various database clusters or achieved high-level administrative access to the platform's production environment.
### Data Exfiltration/Impact
- **March 2026:** Hackers claim to have obtained platform data and list it for sale on cybercrime forums.
- **July 2026:** The full dataset (~11GB) is posted publicly/for free on the dark web after failing to sell or as part of a secondary distribution.
### Detection & Response
- **Detection:** Discovered via external threat intelligence monitoring when the data was listed on a dark web marketplace.
- **Response:** Notification to credential monitoring services (e.g., Have I Been Pwned) took place in July 2026.
## Attack Methodology
- **Initial Access:** Unknown (Likely SQL Injection, compromised administrative credentials, or an exposed API).
- **Persistence:** Not disclosed.
- **Privilege Escalation:** Likely achieved access to database management systems (DBMS).
- **Credential Access:** Stole passwords stored as bcrypt hashes.
- **Collection:** Aggregated 11GB of structured data including banking and payout records.
- **Exfiltration:** Large-scale transfer of database backups or table exports.
- **Impact:** Massive data breach affecting 23.3 million users.
## Impact Assessment
- **Financial:** High risk of fraud for users due to leaked bank account numbers and payout histories.
- **Data Breach:** 23.3 million unique email addresses; 11GB of data including PII (names, addresses, DOB) and bcrypt-hashed passwords.
- **Operational:** Significant impact on platform trust and potential regulatory scrutiny regarding the handling of financial data.
- **Reputational:** High; public listing of data on social media (X[.]com) and news outlets.
## Indicators of Compromise
- **Network indicators:** None provided in the source.
- **File indicators:** `Paidwork_Data_Export_March2026[.]zip` (hypothetical filename based on contents).
- **Behavioral indicators:** Unusual large-scale data egress from production databases.
## Response Actions
- **Containment:** Not disclosed by the organization.
- **Eradication:** Not disclosed.
- **Recovery:** Integration with "Have I Been Pwned" to notify affected users. Advice issued to users to change passwords and enable 2FA.
## Lessons Learned
- **Key Takeaways:** The storage of comprehensive banking and payout data alongside PII creates a high-value target for hackers.
- **Gaps:** There was a significant gap between the initial sale claim (March) and the public leak/notification period (July), suggesting delayed incident identification or disclosure.
## Recommendations
- **Enforce MFA:** Mandatory Multi-Factor Authentication for all user accounts and administrative panels.
- **Data Minimization:** Evaluate if banking information and secondary PII (interests, education) need to be stored long-term in an online-accessible database.
- **Bcrypt Salting:** While bcrypt was used, users should be prompted to rotate keys frequently in case of low-entropy password cracking.
- **Continuous Monitoring:** Implement database activity monitoring (DAM) to alert on large-scale exports of sensitive tables.