ParkMobile, a popular parking app that allows users to pay for street parking, event parking, garage parking, etc, in all major cities with ease through their phones is currently facing a class action lawsuit as a result of a data breach. The deadline to file a settlement is quickly approaching and any individual who had been impacted by this data breach should act fast as the final day to file is March 5, 2025.
ParkMobile data breach
The parking app faced a major data breach in March of 2021 that made vulnerable the personal information of close to 21 million users. The leaked data included email addresses, license plate numbers, phone numbers, and for some, even mailing addresses. The one silver lining of the situation is that payment card information and social security numbers remained unaffected but even so, this breach posed an incredible privacy risk to all involved parties.
Hackers conducted this cyber attack by gaining access to the AWS S3 bucket which held the personal information of 21 million users of the app. An AWS S3 bucket is a cloud computing tool that is commonly used in the industry as a digital storage solution. It allows businesses to store and easily access vast amounts of data in a secure manner and if monitored and configured properly, there should be minimal security risks.
As such, it is more than likely that the cause of this breach was as a result of vulnerabilities commonly seen in cloud storage. Misconfiguration with access control seems to be the top cause of breaches of this nature. If the S3 bucket is left unknowingly left open, any one capable of obtaining the correct URL can gain complete access to view and download the data.
Subsequently, since a data breach had occurred, plaintiffs are accusing the company of failing to implement the necessary security measures to protect any personal data uploaded on the users’ profile. ParkMobile is facing allegations of “negligence in maintaining secure systems, violating state consumer protection laws and breaching its contractual obligations to safeguard user information” as a result of the unauthorized parties gaining access to the Amazon Web Services S3 bucket.
Settlement details
ParkMobile has reached a settlement agreement with plaintiffs amounting to $38.2 million in order to resolve these claims “relating to an unknown actor’s unauthorized access to the Personal Information of ParkMobile App users,” as per the settlement website.
An estimated 21 million users have been affected by this data breach, and whilst only basic user data had been accessed, the breach does still leave room for users to be faced with risks like phishing scams and identify theft.
According to a statement shared with NJ Advance Media, the company has agreed to a settlement payout out so as to “focus on the ongoing protection of our customers’ information and to continue enhancing our services.”
“We prioritize the protection of our customers and their data, continuously enhancing our security posture and monitoring based on industry best practices,” ParkMobile added.
According to the settlement website, eligible individuals will have received a notification regarding the incident directly from the company. However, in order to receive your share of the $38.2 million settlement, class members must submit a valid claim form to ParkMobileSettlement.com.
The maximum payment any class member can receive is $25, provided a claim was submitted.
If a class member did not submit a valid claim form before the deadline cutoff, ParkMobile will send the user a code that will load a $1 credit that can be used on the app. This credit amount will be valid only for one year.
As mentioned above, the deadline to submit a claim is March 5, 2025.