When the Paidwork platform’s database appeared on cybercrime forums in July, it exposed 23.27 million users’ records. The breach, which stemmed from an intrusion in March, included the data you’d expect from a large-scale credential dump: names, email addresses, phone numbers, physical addresses, dates of birth, bcrypt-hashed passwords, and bank account numbers.
But it also included something that doesn’t appear in most breach disclosures: profile photos.
The photographs in that database make this qualitatively different from an ordinary credential breach. Here’s why, and what it means for how you think about where your face ends up.
The Difference Between a Credential Breach and a Face Breach
A credential breach — name, email, password hash — is damaging in specific and well-understood ways. Attackers use it for credential stuffing: testing leaked email and password combinations against other services where you may have reused the same password. They use it for phishing: your name and email address let them write convincing, targeted messages. They use it for account takeover on services with weak authentication.
These attacks have known defenses: unique passwords (using a password manager), two-factor authentication, and phishing awareness all meaningfully reduce exposure.
A face breach is different because a face cannot be changed. You can reset your password. You cannot reset your face.
And a face, combined with your name and personal details, unlocks attack surfaces that credentials alone do not.
What Attackers Can Do With Your Profile Photo
AI-Powered Deepfake Generation
Modern AI tools can take a single photograph and generate video of a person speaking, moving, and expressing emotions they never exhibited. The quality has improved substantially, and detection is uncertain in many real-world contexts.
A bad actor with your name, photo, and basic personal details can generate a video of your face delivering a message you never recorded. This can be used to deceive family members in financial scams — “my phone is broken, I need you to transfer money quickly” — to impersonate you in professional contexts, or to create content used for extortion.
The raw material for this attack used to require access to your social media profiles or direct personal connection. A breach like Paidwork’s distributes it to anyone who downloads the database file.
Social Engineering With Visual Confirmation
Social engineering attacks are more effective when they include visual confirmation of who the attacker claims to be. A scammer running a romance fraud or professional impersonation scheme using your name now has a face to show to targets.
This enables multi-layered impersonation: your photo can be used to create fake social profiles that appear plausible, to reassure fraud targets that they’re communicating with a real person who exists online, or to add visual credibility to identity claims in video calls.
Identity Verification Bypass
A growing number of services use facial matching for identity verification. Banking apps, government portals, and gig economy platforms often require applicants to photograph their face alongside an ID document to confirm identity. Techniques for bypassing liveness detection — using static photos or animated clips to defeat verification systems — have evolved in parallel with detection systems.
The Paidwork breach exposed not just photos but names, addresses, and bank account details, giving attackers multiple components needed to attempt verification bypass on financial and identity-linked services.
Hyper-Targeted Phishing
A phishing message with your name and email address is more credible than a generic appeal. A message that also demonstrates the attacker knows what you look like, mentions your city (from the address data), references a platform you used (Paidwork), and appears to come from a contact whose face you recognize is substantially more effective.
The compounding effect is the point. No single piece of data from this breach enables sophisticated fraud on its own. Combined — name, email, photo, address, bank account, personal interests — the breach produces a phishing substrate that is difficult to dismiss as generic.
Why Platform Profile Photos Are Different From Public Photos
There is an important distinction between photos you actively publish and photos that live in a platform’s backend database.
Photos on a public Instagram or LinkedIn profile are indexable and accessible to anyone who searches for you. That exposure is a trade-off you made explicitly when you chose to publish them.
Profile photos stored in a service like Paidwork are different. You uploaded a photo to access the platform’s features, not to be publicly visible to strangers. You likely assumed the photo was accessible only within the platform context. When the database is breached, those photos enter circulation through a fundamentally different channel than publicly posted images.
Most users have a rough mental model of “public photos” and “private photos” without accounting for a third category: photos you uploaded to access a service, which sit in a company’s database under their control, not yours. The privacy of those photos depends entirely on whether the platform is breached, and on how they stored the data.
Checking Your Own Exposure
The Paidwork breach was added to Have I Been Pwned on July 19. The quickest way to check whether your email address appears is to search it at haveibeenpwned.com, which is free and maintained by security researcher Troy Hunt.
If your address appears in the Paidwork breach, several immediate steps are worth taking.
Change any password reused from Paidwork. Even though the passwords are stored as bcrypt hashes, automated cracking tools make progress against weaker passwords over time. Treat any password used at Paidwork as effectively compromised and update it anywhere you’ve reused it.
Monitor for unusual financial activity. Bank account numbers were part of this breach. Enable transaction alerts if your bank supports them and review recent statements closely.
Be alert for highly targeted phishing. Messages that reference Paidwork, mention details about you that shouldn’t be widely known, or create unusual financial urgency should be treated with heightened suspicion in the months following this breach.
Alert people who might be targeted on your behalf. If attackers use your photo in a family impersonation scheme, your relatives are the actual targets. Let them know to be skeptical of urgent financial requests that appear to come from you via unusual channels — particularly video or voice messages.
The Storage Decision That Makes the Difference
Not every breach exposes profile photos. Whether photos are included depends on how a platform stores them.
Platforms that store profile images as files in the same environment as their user database — which is common — expose those images in any breach that also affects the database. Platforms that separate image storage from account data, apply independent access controls to image storage, or don’t retain profile images beyond operational necessity, contain the blast radius.
Most platforms don’t tell you how they store profile images. It’s not typically disclosed in privacy policies because it’s treated as an implementation detail rather than a data category. When you upload a photo to create a profile on any platform, you’re making an inference about privacy based on minimal information.
The practical rule that follows is simple: be more selective about where you put photos of yourself than you may have been. For platforms where a profile photo is required and you can’t avoid it, using an image where you’re not easily identifiable — or a non-photographic avatar where the platform allows it — reduces what appears in a potential breach.
For personal photos you actively want to keep private — family photos, personal memories, photos of your home or location — those belong somewhere with an explicit access control model and a clear answer to the question of who can reach them and under what conditions.
daftei stores files encrypted at rest with AES-256 and in transit with TLS 1.3. Files you upload are not publicly indexed, not visible to other users, and not processed for any purpose other than your own storage and retrieval. The platform is GDPR and CCPA compliant, never sells user data, and doesn’t train third-party AI on your content. When you delete your account, there is a 30-day grace window before permanent, irreversible erasure.
The Paidwork breach is a reminder that where you store your photos and personal files determines who can access them — not just whether you set the privacy toggle in an app.