ParkMobile Parking Payment App Breach (2021): 21 Million Customer Records Including Vehicle License Plates & Passwords Exposed

About ParkMobile

ParkMobile is a mobile parking payment and reservation platform that allows drivers to pay for street parking, garages, and event parking via a smartphone app or website. The company is headquartered in Atlanta and serves municipal parking systems, universities, airports, and commercial parking operators across the United States. It is one of the largest parking technology providers in the country.

Why They Hold Your Data

Parking-payment platforms collect user identity, phone numbers, vehicle information, payment-adjacent data, location-linked parking records, and reservation history across urban mobility workflows.

Recent Developments

ParkMobile was acquired by EasyPark Group in 2021, the same year as the breach. It has continued expanding its municipal and campus parking partnerships under that ownership. The $32.8 million class-action settlement resolved the primary legal consequence of the 2021 incident.

Data Points Exposed

Breach Impact

In March 2021 ParkMobile disclosed a cybersecurity incident linked to a vulnerability in a third-party software it used, resulting in unauthorized access to data for approximately 21 million customers. Exposed data included license plate numbers, email addresses, phone numbers, and bcrypt password hashes. Within weeks the full dataset appeared on a public hacking forum. ParkMobile notified affected users, reported to law enforcement, and eliminated the third-party vulnerability. A class-action lawsuit alleged failure to implement reasonable cybersecurity measures and inadequate encryption practices. In December 2024 ParkMobile agreed to a $32.8 million settlement — one of the larger parking industry breach settlements on record. Class members received $1 in-app credit or up to $25 in cash, reflecting the relatively limited financial harm profile of the exposed data.

Exploitation & Downstream Threats

• Credential stuffing against reused passwords across other platforms | • SIM swap attacks where phone numbers are present | • Targeted phishing campaigns using exposed email addresses | • Doxxing risk from physical address exposure

What You Should Do

1. Treat the home address as exposed: review mail and package handling and physical-security routines, and brief household staff to verify unusual requests.
2. Reset any reused passwords and enable MFA on email first, then financial accounts.
3. Guard against SIM-swap and vishing: add a carrier port-out PIN and verify any 'support' calls independently.
4. Do not use unofficial 'am I affected' lookups; several are themselves harvesting operations.

How ObscureIQ Can Help

1. Corpus confirmation: determine whether and where the principal (plus household and staff) appear in this dataset and which specific fields are exposed for them.
2. Exposure mapping and footprint neutralization: cross-reference against broker-available data and suppress still-removable elements, prioritizing address and phone, since this record re-seeds broker networks.
3. ThreatWatch tuned to this incident's identifiers and misuse pattern (impersonation and targeting patterns, not generic credential monitoring).