Gig‑Economy Platform Paidwork Exposes 23.3 M User Records Including Financial and Personal Data
What Happened
In March 2026 threat actors announced they had harvested data from the freelance‑marketplace Paidwork. By July they publicly released ≈ 11 GB of the dump, containing more than 23 million unique email addresses and a full spectrum of personal, financial, and credential information (bank account numbers, payout history, bcrypt‑hashed passwords, etc.).
Why It Matters for Compliance & Audit Readiness
- Continuous control‑assurance programs must capture vendor‑side data‑handling failures as a core control, not just rely on periodic vendor questionnaires.
- Evidence of encryption, hashing, and access‑logging must be defensible during audits; the breach shows that even strong password hashing (bcrypt) does not protect against wholesale data exfiltration.
- Real‑time monitoring of outbound data flows and anomaly detection can surface large‑scale extraction events before they are posted publicly.
Who Is Affected
- Gig‑economy platforms and marketplace operators
- Freelancers, contractors, and gig workers using Paidwork
- Payment processors and financial institutions linked to payout transactions
- Third‑party services that integrate with Paidwork (e.g., identity‑verification providers)
Recommended Actions
- Review your organization’s exposure to Paidwork‑derived data (direct users or integrated services).
- Validate that encryption‑at‑rest, hashing, and key‑management controls are documented and regularly tested.
- Strengthen outbound data‑flow monitoring and implement alerts for large‑scale data transfers.
- Request a detailed incident‑response report from Paidwork and update your third‑party risk register.
- Rotate any shared credentials and enforce MFA for all privileged access to the platform.
Technical Notes
- Attack vector: Data exfiltration from Paidwork’s backend systems; the precise entry point has not been disclosed.
- CVEs: None reported.
- Data types exposed: Email addresses, names, physical addresses, phone numbers, dates of birth, genders, IP addresses, device information, education levels, personal interests, profile photos, bank account numbers, financial transaction history, bcrypt‑hashed passwords.
Source: https://haveibeenpwned.com/api/v3/breach/Paidwork