Poshmark – 36.4 M User Accounts Exposed in 2018 Data Breach
What Happened — In mid‑2018 the social‑commerce platform Poshmark suffered a breach that released the personal data of 36,395,491 user accounts, including email addresses, names, usernames, genders, geographic locations, and passwords stored as bcrypt hashes.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk when credential stores are not continuously monitored for unauthorized access.
- Highlights the need for documented password‑policy controls (hashing standards, rotation, MFA) that can be evidenced during audits.
- Shows how a breach of personal data can trigger regulatory and reputational fallout, underscoring the value of a defensible, continuously‑collected control‑assurance program.
Who Is Affected – Retail/e‑commerce platforms, online marketplaces, and any service that stores user credentials at scale.
Recommended Actions – Review and harden password‑storage practices (ensure strong, salted hashing, enforce MFA), implement continuous monitoring of credential‑access logs, and prepare evidence of these controls for audit readiness.
Technical Notes – The breach exposed bcrypt‑hashed passwords along with PII such as email, name, gender, location, and username. The exact attack vector was not disclosed. Source: Have I Been Pwned – Poshmark breach