More than 23 million people who signed up to earn money from online gigs have allegedly had their personal and financial information spilled onto the internet following a breach of microtask platform Paidwork. The incident was added to Troy Hunt's Have I Been Pwned site after a database allegedly stolen from Paidwork was publicly released earlier this month. According to the breach notification service, the leak contains data on 23,272,765 users and traces back to an intrusion in March. The database first surfaced in April when someone using the handle "HACKFORMETOME" advertised what they claimed was an 11 GB dump from Paidwork's production systems on a popular cybercrime forum. At the time, the seller claimed the database contained records on more than 22 million users and attempted to auction it through Telegram and Tox. The alleged breach at Paidwork appeared in Have I Been Pwned on July 19. According to the breach listing, the exposed information goes well beyond names and email addresses. The data reportedly includes bank account numbers, phone numbers, physical addresses, dates of birth, profile photographs, IP addresses, device information, financial transaction records, payout histories, education levels, and passwords stored as bcrypt hashes. While bcrypt makes password cracking significantly harder than older hashing algorithms, weak passwords may still be recovered. Paidwork had not publicly acknowledged the alleged breach at the time of writing. The Register asked the company to confirm the authenticity of the leaked data and detail what steps it has taken to notify affected users, but the company didn't immediately respond. Paidwork markets itself as a way to earn money through small online tasks such as playing mobile games, watching advertisements, completing surveys, testing apps, shopping through cashback offers, and referring other users. Most individual jobs pay only a few cents, with workers required to earn at least $10 before cashing out. For Paidwork users, that modest payday may now come with a much larger bill. Anyone who reused their password elsewhere should change it immediately, keep an eye on financial accounts, and be alert for phishing emails built from the trove of personal information now circulating online. ®
