cyber-crime
HIBP claims leaked info includes bank account numbers, payout histories, and personal details
More than 23 million people who signed up to earn money from online gigs have allegedly had their personal and financial information spilled onto the internet following a breach of microtask platform Paidwork.The incident was added to Troy Hunt's Have I Been Pwned site after a database allegedly stolen from Paidwork was publicly released earlier this month. According to the breach notification service, the leak contains data on 23,272,765 users and traces back to an intrusion in March.The database first surfaced in April when someone using the handle "HACKFORMETOME" advertised what they claimed was an 11 GB dump from Paidwork's production systems on a popular cybercrime forum. At the time, the seller claimed the database contained records on more than 22 million users and attempted to auction it through Telegram and Tox.
The alleged breach at Paidwork appeared in Have I Been Pwned on July 19.
According to the breach listing, the exposed information goes well beyond names and email addresses. The data reportedly includes bank account numbers, phone numbers, physical addresses, dates of birth, profile photographs, IP addresses, device information, financial transaction records, payout histories, education levels, and passwords stored as bcrypt hashes. While bcrypt makes password cracking significantly harder than older hashing algorithms, weak passwords may still be recovered.
