ParkMobile

ParkMobile is a United States-based technology company that provides a mobile application enabling users to pay for parking in urban and municipal environments. The service allows drivers to locate, pay for, and manage parking sessions via their smartphones, eliminating the need for physical payment kiosks. At the time of its 2021 cybersecurity incident, the platform served a substantial user base, with the breach affecting approximately 21 million accounts, indicating significant market penetration across numerous American cities. The company was operating amid a notable corporate transition, as it had recently announced its acquisition by a European parking group, a context that framed the incident's discovery and public disclosure. This acquisition underscored ParkMobile's position as a significant asset in the digital parking sector, valued for its widespread user adoption and integrated payment infrastructure.

The March 2021 incident stemmed from a vulnerability within a third-party software component, which attackers exploited to access the company's database. The breach exposed a wide array of user information, including email addresses, phone numbers, license plate numbers, vehicle nicknames, and some mailing addresses, while bcrypt-hashed passwords were also compromised. Critically, payment card details and highly sensitive data such as Social Security numbers were not affected, limiting the financial fraud risk for many users. Following the discovery, ParkMobile engaged external cybersecurity experts to investigate, notified law enforcement, and patched the vulnerable software. However, the company's response did not include enforcing password resets for the affected millions, a decision that drew scrutiny. Subsequently, the stolen data was advertised for sale on a cybercrime forum, extending the potential harm beyond the initial breach and highlighting the long-term risks associated with such exposures.