Paidwork · Breach

Actor claims sale of 23 million Paidwork user records

Oct 30, 2026 · 1 min read

A threat actor is offering for sale on a cybercrime forum what it claims is an 8.4 GB Paidwork database, from an online earning and rewards platform, with about 23 million rows of user data. The records allegedly include full names, email and physical addresses, billing details, withdrawal methods, bank account numbers and crypto wallet information. The claim is unverified with no official statement; DailyDarkWeb warns of targeted phishing and payout fraud.

By HIFY Radar newsroom Updated 10/30/2026 04:27 AM Get this every day →← Back to the feed 1 source

HighBreachNo software to update

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

A threat actor is offering for sale on a cybercrime forum an alleged 8.4 GB Paidwork database with about 23 million rows of user data. Records allegedly include names, emails, addresses, billing details, bank account numbers and crypto wallet information. The claim is unverified and the company has not commented.

Why it matters

If confirmed, the leak would expose sensitive financial data, including bank account numbers and crypto wallets, from a platform that pays users. Even unverified, the post is a strong lure for targeted phishing and payout fraud, according to the analyst note.

What to do

Watch Paidwork's official channels for a statement and have the security team track verification of the database. Warn users and staff about fake withdrawal or account verification messages.

For the technical team

Affected: Paidwork, plataforma online de ganhos e recompensas; base alegada de 8,4 GB com cerca de 23 milhões de linhas de dados d · Paidwork, an online earning and rewards platform; alleged 8.4 GB database with about 23 million rows of user data.
Exploitation: Unverified threat-actor claim reported by DailyDarkWeb. No breach confirmation and no official statement from the company.
Fix: Not applicable; alleged leak with no patch or fix.
Vector: Data leak announced on a cybercrime forum; the source does not state how the database was obtained or the intrusion vector.
More details: Alleged fields: full names, email and physical addresses, billing details, withdrawal methods, bank account numbers, crypto wallet information and personal identification details. DailyDarkWeb rates the post as a strong lure for targeted phishing and payout fraud, and recommends watching for fake withdrawal or account verification messages.