Poshmark 2018 Data Breach
Platform · Fashion resale marketplace · Social commerce platform · Global
Poshmark Fashion Resale Marketplace Breach (2018): 36 Million User Accounts Including Passwords Exposed
Social commerce marketplace for fashion.
Confirmed · ObscureIQ Intelligence
Breach Risk Index i
19/100
Lower riskHigher risk
Lower: limited current risk based on data value and recency.
Data Sensitivity i
StandardExposed data is largely lower-sensitivity. Standard identity-protection precautions are advised.
36.4MRecords
2018Year
The Breach Risk Index (BRI) is a proprietary 0–100 score rating how dangerous a breach is right now, based on how recently the data has been circulating on the dark web and how valuable it is to attackers.
Breach Summary
Poshmark, a social commerce marketplace where users buy and sell clothing and goods, suffered a data breach in mid-2018 that exposed approximately 36.4 million user accounts. An unauthorized third party accessed user data through a misconfiguration. The breach was not publicly disclosed until August 2019, more than a year after it occurred, when Poshmark announced the incident after being contacted by security researchers. The exposed data included email addresses, full names, usernames, genders, geographic locations, and passwords. The passwords were stored using bcrypt, a relatively strong hashing method, which reduces but does not eliminate the risk of them being cracked. Financial information and physical addresses were not affected. Because Poshmark combines social networking with retail activity, the exposed data can also reveal users' shopping habits and personal interests, adding context that makes phishing and impersonation attempts more convincing. Poshmark notified affected users, forced password resets, and advised users to update passwords on any other accounts where the same credentials were used. No prominent class-action settlement or regulatory action has been documented in connection with this breach. Affected individuals remain at risk of targeted phishing, account takeover, and seller impersonation, particularly if they reused their Poshmark password elsewhere.
Full threat analysis, exploitation vectors, and principal guidance below.
10 additional sections · verified field analysis · defensive doctrine
Querying breach corpus…
Cross-referencing exposed field types…
Resolving threat-actor attribution…
Compiling principal risk advisory…
36.4M records analyzed
About Poshmark
Poshmark is a social commerce marketplace where individuals buy and sell new and secondhand clothing, accessories, and home goods. Founded in 2011 and headquartered in Redwood City, California, the platform went public on Nasdaq in 2021 before being acquired by South Korean internet company Naver in 2023 for approximately $1.2 billion. The platform combines social networking features — following, sharing, and liking — with peer-to-peer retail commerce.
Why They Hold Your Data
Social-commerce marketplaces collect buyer and seller identity, contact details, addresses, payment-adjacent data, transaction histories, and social-engagement records across resale workflows.
Recent Developments
Following Naver's 2023 acquisition, Poshmark has operated as part of the same portfolio as Wattpad and the Naver-affiliated webtoon ecosystem. The company has continued developing its marketplace features and expanding in international markets. No major standalone organizational developments beyond the acquisition context have been prominently reported.
Data Points Exposed
6 verified field types
Email Address
Full Name
Gender
Geographic location
Password High
Username
Breach Impact
In mid-2018 Poshmark suffered a breach exposing approximately 36 million user accounts. The exposed data included email addresses, full names, usernames, genders, geographic locations, and passwords stored as bcrypt hashes. Poshmark disclosed the incident in August 2019 after being contacted by security researchers. The company notified users, forced password resets, and advised users to change passwords on other accounts where the same credentials had been used. No class-action settlement or significant regulatory action specific to this breach has been prominently documented.
Exploitation & Downstream Threats
• Credential stuffing against reused passwords across other platforms | • Targeted phishing campaigns using exposed email addresses | • Doxxing risk from physical address exposure
Principal Risk Advisory
What this means for a principal
A consumer-service breach: contact and account data supports phishing, account takeover and profile enrichment. For a high-profile principal the main risk is credible impersonation and enrichment of existing exposure.
What You Should Do
- Reset any reused passwords and enable MFA on email first, then financial accounts.
- Do not use unofficial 'am I affected' lookups; several are themselves harvesting operations.
How ObscureIQ Can Help
- Corpus confirmation: determine whether and where the principal (plus household and staff) appear in this dataset and which specific fields are exposed for them.
- Exposure mapping: cross-reference the exposed identifiers against broker-available data to size and prioritize the principal's wider footprint.
- ThreatWatch tuned to this incident's identifiers and misuse pattern (impersonation and targeting patterns, not generic credential monitoring).
Protect Yourself
Check If You're Affected
Enter your email to check whether your data appears in this breach. We’ll send a 6-digit code to confirm it’s your address.
Get Free Breach Alerts
Be the first to know when new breaches are disclosed. Free forever — confirm your email with a 6-digit code.
High-Risk? Get an Exposure Audit
Executives, public figures, and high-visibility operators can receive tailored exposure intelligence and hardening guidance.
Request Consultation