An unverified WorkL dataset indexed by leaksear.ch contains 29,172 account records tied to WorkL, a workplace intelligence platform for employee surveys, workplace data, and recruitment services (leaksear.ch metadata) (workl.com). The indexed data includes emails, usernames, password hashes, names, countries, and application metadata, with no breach date listed (leaksear.ch metadata).
What happened
leaksear.ch indexed the WorkL dataset on October 14, 2026; the metadata marks it unverified and does not identify a breach date, threat actor, intrusion vector, or source of exposure (leaksear.ch metadata). WorkL's privacy policy identifies Engaging Works Group Limited, trading as WorkL For Business and WorkL, as the owner and operator of the services and a company registered in England and Wales (app.business.workl.com).
Public sources reviewed for this article did not confirm a WorkL breach notice or explain how this account data was exposed. WorkL's official site describes a platform for workplace intelligence, employee surveys, awards, recruitment, consultancy, and data insights; those service descriptions provide context, not confirmation of any breach mechanism (workl.com).
What data was exposed
The leaksear.ch index lists these searchable fields: country, email, hashedPassword, name, and username (leaksear.ch metadata). The metadata also lists stored record context fields, including record_id, source_data, and source_table, and describes the dataset as containing application metadata (leaksear.ch metadata).
The password material is described only as hashedPassword. The hash algorithm, salt status, and whether any hashes are crackable are not included in the metadata (leaksear.ch metadata); NIST guidance says password hashes should be salted and use a suitable cost factor to make guessing attacks expensive when an attacker obtains a hashed password file (pages.nist.gov).
No phone numbers, postal addresses, payment card data, national IDs, or plaintext passwords are listed in the supplied leak metadata (leaksear.ch metadata).
Why this matters
Email addresses paired with names and usernames can support targeted phishing that references WorkL accounts, surveys, or recruitment services, because WorkL publicly describes employee surveys and recruitment services as part of its offering (leaksear.ch metadata) (workl.com). Password hashes can still create account risk if users reused the same password elsewhere and an attacker cracks weak hashes, and CISA says exposed credential material such as usernames, emails, and passwords can be used for phishing, credential-based campaigns, resale, and targeted intrusion (content.govdelivery.com). Country values give attackers a simple way to localize phishing lures when combined with email and name fields (leaksear.ch metadata). Security teams should monitor for login attempts and password reset traffic on exposed emails or usernames, and affected users should change any reused passwords and enable MFA where available, matching CISA's guidance for potential credential compromise (content.govdelivery.com).
Check your exposure
Request access to check this leak source, or sign in if you already have an account. You can search it by country, email, hashed password, name, and username.
Sources
- WorkL: Improve Employee Engagement & Retention
- WorkL For Business: Engaging Privacy Policy
- National Institute of Standards and Technology: SP 800-63B Digital Identity Guidelines
- Cybersecurity and Infrastructure Security Agency: CISA Releases Guidance on Credential Risks Associated with Potential Legacy Oracle Cloud Compromise