Airtasker Data Breach: Support Tickets Downloaded, Some With IDs and Card Numbers

What Was Taken

For most people, Airtasker says, it was contact details (name, email address and phone number) plus the text of the support requests they had sent. For some, the data also showed basic account activity, such as how many tasks they had posted or completed.

The sensitive part is what people put into those requests themselves. Customers sometimes sent documents such as a driver’s licence to verify their identity or sort out a problem. In a very small number of cases, someone had typed card details into a support message, and a small number of people had shared a password there. Airtasker says it has emailed those people directly.

Card and payment details stored in Airtasker accounts were not involved, and for most people neither was their Airtasker password. Airtasker accounts generally weren’t accessed, the notice says.

Airtasker doesn’t play down whether the data left. It tells affected users their information “is likely to have been downloaded”, so they should assume it was taken.

The breach also reaches people who left the platform. To someone who deleted their account years ago, Airtasker answers that it keeps support records for a set period to help with ongoing issues and meet legal obligations. It doesn’t say how long that period is.

The Scam Airtasker Is Warning About

According to the notice, the intruder “took steps that suggest they were preparing a payment scam”, such as fake Airtasker emails asking for bank details. Airtasker tells users to watch for emails, texts or calls that say a payment is “on hold”, ask for bank details, or ask them to sign in through a link.

On a marketplace where Taskers wait for their money to be released, a “payment on hold” message is an easy story to believe. Add a real name, a real phone number and details from a past support conversation, and it reads like a message from someone who knows your case.

Airtasker says it will never ask for your bank details, card number or password by email, text, phone or link. Its own breach email doesn’t ask you to click a link to sign in. If someone calls unexpectedly and says they’re from Airtasker, it advises you to hang up and block the number.

Fakes can be reported to [email protected] and, in Australia, to Scamwatch.

Why Support Inboxes Are a Target

A support inbox collects whatever people send when they want a problem fixed quickly: a photo of a licence, a card number, a password so that someone can check an account. Airtasker says it never asks for card numbers, but they still turn up, and its staff remove sensitive details when they spot them.

Since the breach, card numbers are removed from support messages automatically, files shared with support get extra protection, and older records are being reviewed to strip out sensitive information. None of that reaches the copies that were already downloaded.

It has happened before. In October 2025, Discord said an attacker had compromised 5CA, one of its customer service providers. About 70,000 users may have had government-ID photos exposed, images the vendor used to review age-related appeals.

Australian privacy law also has a rule on keeping data. Under Australian Privacy Principle 11.2, a business must take reasonable steps to destroy or de-identify personal information once it no longer needs it, unless a law or a court order requires it to be kept. Whether a years-old ID photo in a closed ticket was still needed is a question for Airtasker and, if people complain, the Office of the Australian Information Commissioner (OAIC).

What to Do If Airtasker Emailed You

The email lists which kinds of your data were involved. Don’t follow links in any message about the breach. Open the Airtasker app or type airtasker.com yourself.

If you want to know exactly what Airtasker holds about you, you can request a copy through the form in its help article on data access; it says requests are handled within 30 days. Its privacy policy also lets you ask for your personal data to be deleted, though it warns that copies in backups may not go straight away.

Airtasker links to the OAIC’s page on identity fraud for the signs that someone is using your identity, such as bills, accounts or messages you don’t recognise.

What Airtasker Hasn't Said Yet

Several basic questions are still open. The notice doesn’t say how many people were affected, how the intruder got in, which outside company runs the support system, or how long support records are kept.

It also doesn’t say where the affected people live. The notice sits on Airtasker’s Australian help centre and names only the Australian regulator. Airtasker also runs marketplaces in the UK and the US, and its privacy policy names Airtasker UK Limited as the company responsible for UK users’ data.

Airtasker says it is notifying the relevant authorities, including the OAIC. Under Australia’s Notifiable Data Breaches scheme, a company has to take reasonable steps to assess a suspected breach within 30 days and must tell the OAIC and the people affected as soon as practicable once it believes serious harm is likely. Airtasker began emailing people three days after it found the access.

Airtasker is listed on the Australian Securities Exchange. By 14 November, 08:20 UTC, it had posted no announcement there about the incident.