Poshmark poshmark.com Poshmark data breach: what happened and what to do
In mid-2018, social marketplace Poshmark was breached and an unauthorized third party took user data. Have I Been Pwned counts 36 million accounts, with email addresses, names, usernames, genders, locations and passwords stored as bcrypt hashes.
View all 13,115 breaches- Breach date
- 16 May 2018
- Affected
- 36,395,491
- Data exposed
- Email addresses, Genders, Geographic locations, Names, Passwords, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
Poshmark, the social commerce marketplace for buying and selling clothes, confirmed a data breach on its blog in August 2019. The data had been taken by an unauthorized third party. Have I Been Pwned dates the breach to May 2018 and lists 36,395,491 accounts, which it received in September 2019.
Poshmark said it hired the forensics firm Kroll to investigate. It also said financial information and physical addresses weren't compromised.
What was exposed
The exposed data covers email addresses, names, usernames, genders and locations. It also includes passwords, which were stored as bcrypt hashes. Bcrypt is a slow method designed to resist cracking, so these hashes are much harder to recover than MD5 or SHA-1 ones.
What it means for you
The combination of a name, username and email address lets criminals write messages that look like they come from the marketplace, such as a buyer asking you to move to another chat or a fake shipping label. Poshmark users often chat with strangers, so a polite message that uses your real name is easy to trust.
The bcrypt hashing lowers the risk that your password was recovered, but a weak or common one can still fall. If you reused it, treat that password as burned.
Change your Poshmark password if it dates from before 2019, and don't continue a deal or payment outside the app, even if the other person knows your username.
What to do if you were in it
- 1
Change the password and anywhere you reused it
Set a new password on the affected account. Then change it on any other site where you used the same one, starting with email and banking. A password manager makes unique passwords painless.
- 2
Turn on two-factor login
Use an authenticator app or a security key on your email, bank and shopping accounts. A stolen password alone then isn't enough to get in.
- 3
Expect phishing that mentions the breach
Criminals use your name, username and city to write messages that look personal. Don't click links in unexpected emails or texts about your account. Go to the site directly instead.
- 4
Keep trades and payments inside the app
Ignore requests to move to text, email or a payment link outside Poshmark, even when the sender knows your real name.
- 5
Check whether your email or phone is in this and other breaches
Run a free scan with Serus to see which breaches include your email address or phone number. Serus monitors breach databases and the dark web and alerts you if your data shows up again.
Frequently asked
Was I affected by the Poshmark data breach?
If you had a Poshmark account in 2018, possibly. Search your email address on Have I Been Pwned to see whether it appears.
What was exposed?
Email addresses, names, usernames, genders, locations and passwords stored as bcrypt hashes.
Were my card details or address leaked?
Poshmark said financial information and physical addresses weren't compromised.
Should I change my password?
Yes, if you haven't since 2018 or if you reused it on other sites.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
