Poshmark, a social commerce marketplace where users buy and sell clothing and goods, suffered a data breach in mid-2018 that exposed approximately 36.4 million user accounts. An unauthorized third party accessed user data through a misconfiguration. The breach was not publicly disclosed until August 2019, more than a year after it occurred, when Poshmark announced the incident after being contacted by security researchers. The exposed data included email addresses, full names, usernames, genders, geographic locations, and passwords. The passwords were stored using bcrypt, a relatively strong hashing method, which reduces but does not eliminate the risk of them being cracked. Financial information and physical addresses were not affected. Because Poshmark combines social networking with retail activity, the exposed data can also reveal users' shopping habits and personal interests, adding context that makes phishing and impersonation attempts more convincing. Poshmark notified affected users, forced password resets, and advised users to update passwords on any other accounts where the same credentials were used. No prominent class-action settlement or regulatory action has been documented in connection with this breach. Affected individuals remain at risk of targeted phishing, account takeover, and seller impersonation, particularly if they reused their Poshmark password elsewhere.

Social-commerce marketplaces collect buyer and seller identity, contact details, addresses, payment-adjacent data, transaction histories, and social-engagement records across resale workflows.

Following Naver's 2023 acquisition, Poshmark has operated as part of the same portfolio as Wattpad and the Naver-affiliated webtoon ecosystem. The company has continued developing its marketplace features and expanding in international markets. No major standalone organizational developments beyond the acquisition context have been prominently reported.