Earnings leaked: what it means and what to do

What this data is

Your salary, wages, bonuses or other income amounts, usually from payroll systems, accounting software, loan applications, recruitment platforms or gig work apps.

The risk on its own

Knowing your pay does not let anyone move money out of your account. The harm is privacy and targeting: most people keep their salary private from colleagues, friends and family. A high figure also puts you near the top of a fraudster's list.

The risk combined with other data

With your name, employer and bank details from a payroll breach, earnings make fraudulent loan applications more believable because the stated income matches reality. They also support payroll diversion, where a criminal posing as you asks HR to send your pay to a new account. Payslip details can be copied to fake income documents.

How criminals use it

• An email that appears to come from you asks your HR team to pay your salary into a new bank account.
• A fraudster uses your real income figures to apply for a personal loan in your name.
• Investment scammers target high earners on the list with offers sized to their income.
• Leaked salary figures circulate among colleagues and cause conflict at work.

What to do now

1. Ask your payroll team to require phone or in person confirmation before any change to your bank details.
2. Log in to your payroll or employee portal and confirm your bank account and tax details are unchanged.
3. Change the portal password and turn on two-factor authentication.
4. Place a credit freeze if your date of birth, address or ID numbers leaked in the same breach.
5. Ignore unsolicited investment offers that seem to know your income.

Frequently asked questions

Can someone take my pay because they know my salary?

Not directly. The risk is payroll diversion, where a fake request asks HR to change your bank details, so ask your employer to verify any change by phone or in person.

Is it against the law for my salary to be leaked?

It may be, depending on how the company protected the data. You can complain to the organisation and then to your privacy regulator.

Will this affect my tax?

Only if tax or social security numbers leaked too. In that case ask your tax authority about extra protection, such as an Identity Protection PIN from the IRS in the US.

Breaches that exposed this data

• WiredBucks: 2022-05-25, 919K accounts, Earnings, Email addresses, IP addresses, Names, Passwords, Physical addresses

Tools that help

• Email Breach Check
• Email Header Analyzer
• Password Checker

Related guides

• HR and Payroll Data Leak: Protect Your Pay, Tax and ID
• Credit Freeze Guide: US, Australia, UK and Canada Steps
• Phishing Red Flags: Spot a Fake Email Before You Click
• Identity Theft Checklist: What to Do in the First 48 Hours