ParkMobile parkmobile.io ParkMobile data breach: what happened and what to do
Have I Been Pwned lists a ParkMobile breach from March 2021 covering 20,949,825 accounts. Exposed: email addresses, names, phone numbers, vehicle licence plates and passwords stored as bcrypt hashes. ParkMobile said payment card data was not accessed.
View all 13,115 breaches- Breach date
- 21 Mar 2021
- Made public
- 26 Mar 2021
- Affected
- 20,949,825
- Data exposed
- Email addresses, Licence plates, Names, Passwords, Phone numbers
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
Have I Been Pwned (HIBP) dates the ParkMobile breach to 21 March 2021 and added it to its database on 30 April 2021. It lists 20,949,825 accounts. ParkMobile, a parking payment app used in many US cities, posted a notice on 26 March 2021 describing a cybersecurity incident linked to a vulnerability in third-party software that it uses. A later update said preliminary findings showed that no sensitive data or payment card information had been accessed.
In April 2021 the stolen data appeared for sale on cybercrime forums, and security reporter Brian Krebs published what was in it. The ParkMobile case is a good example of a breach that exposes a lot of accounts but a narrow set of fields.
What was exposed
HIBP lists five data types: email addresses, names, phone numbers, vehicle licence plates and passwords. The passwords were not stored in plain text. A ParkMobile spokesperson confirmed that bcrypt hashed and salted passwords were taken, and that the company does not keep the salt values in its systems. Bcrypt is a slow one-way scheme designed to make guessing expensive, but weak passwords can still be cracked from hashes, especially short or common ones.
ParkMobile said payment card information was not accessed. That matches the HIBP data types, which list no card numbers.
What criminals can do with it
The password hashes are the main concern for anyone who reused their ParkMobile password. Attackers try cracked passwords against other sites in what is called credential stuffing, so a weak password that was reused on email or shopping accounts is the risk. A strong, unique password protects you even if the hash is cracked.
Licence plates are the unusual part. A plate tied to a name and a phone number links a vehicle to a person. It isn't enough to find where you live by itself, but it gives scammers a believable detail for a message about a parking fine or a towed vehicle. Parking and traffic fines are a popular scam theme, with fake text messages that ask you to pay online. Phone numbers make those texts possible.
Names, emails and numbers together are the standard material for phishing. The breach is several years old, which does not make the data stale: email addresses and phone numbers change slowly, and old breach data keeps circulating.
ParkMobile's response
The company's notice said it had fixed the vulnerability, was working with outside cybersecurity experts and had notified law enforcement. It recommended that users change their passwords as a precaution. Users who had not used the app were sometimes surprised to be included, because accounts are created when someone pays for parking even once.
Are you affected?
If you have ever paid for parking through ParkMobile, check your email address on HIBP. Because the breach dates from 2021, check older email addresses too. If it appears, work through the steps below, starting with passwords.
What to do if you were in it
- 1
Change the password anywhere you reused it
If your ParkMobile password matches any other account, change it on those accounts first, starting with email and banking. Use a password manager to create a unique one for each.
- 2
Turn on two-factor authentication
An authenticator app or a hardware key on your email and financial accounts stops a cracked password from being enough on its own.
- 3
Be wary of parking fine texts
Messages about unpaid parking, towing or fines that include a payment link are a common scam. Check with the city or the real parking operator, and don't pay through a link in a text.
- 4
Expect phishing that uses your name and number
Your name, email and phone are exposed. Treat unexpected messages that mention an account or a payment with suspicion.
- 5
Check whether your email or phone is in this and other breaches
Run a free scan at https://www.serus.ai. Serus monitors breach databases and the dark web and alerts you when your data appears, so you hear about the next one without searching for it.
Frequently asked
Was I affected by the ParkMobile data breach?
Check your email address on Have I Been Pwned or run a free Serus scan. HIBP lists 20,949,825 accounts for this breach.
What data was exposed in the ParkMobile breach?
Have I Been Pwned lists email addresses, names, phone numbers, vehicle licence plates and passwords. The passwords were stored as bcrypt hashes.
Were my payment card details exposed?
ParkMobile said payment card information was not accessed, and HIBP lists no card data.
Should I change my password?
Yes, if you have not already. Change your ParkMobile password and any other account where you used the same one.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
