ParkMobile Data Breach Exposes Over 20 Million Customer Records
What Happened
In March 2021 the mobile parking‑service provider ParkMobile suffered a breach that compromised 20,949,825 user accounts. The exposed data set includes email addresses, full names, phone numbers, vehicle licence‑plate numbers and password hashes (bcrypt). The compromised dataset appeared on a public hacking forum the following month and has been widely redistributed.
Why It Matters for Compliance & Audit Readiness
- Demonstrates the need for continuous control‑assurance that validates credential storage practices (e.g., hashing algorithms, salting, and access restrictions).
- Highlights the importance of documented incident‑response procedures and evidence collection to satisfy audit requirements under frameworks such as NIST CSF and ISO 27001.
- Reinforces the value of ongoing vendor risk monitoring to ensure third‑party services maintain appropriate security controls and timely breach notifications.
Who Is Affected
- Transportation and parking‑service providers
- Mobile‑app platforms handling personal and vehicle data
- Any organization that integrates ParkMobile’s API or SDK for payment processing
Recommended Actions
- Review your exposure to ParkMobile as a vendor or data processor.
- Validate that password storage follows industry‑best practices (e.g., strong hashing, limited access).
- Ensure continuous monitoring alerts on credential‑theft indicators and data‑exfiltration patterns.
- Request a detailed incident‑response disclosure from ParkMobile to update your risk register.
Technical Notes
- Attack vector: Not publicly disclosed; breach likely involved unauthorized access to backend data stores.
- CVE(s): None reported.
- Data types: Email addresses, names, phone numbers, licence‑plate numbers, bcrypt‑hashed passwords.