Parking app breach affects 20 million users, including Pittsburgh Parking Authority customers

More than 20 million users of an app used to pay for parking were exposed to a data breach last month, the company that administers the app said.

Included among them are those who use the Pittsburgh Parking Authority’s app, Go Mobile Pittsburgh.

The data that was accessed includes license plate numbers, email addresses and nicknames for vehicles customers use on the mobile app, which is part of the Park Mobile network that has more than 20 million users across the country.

No credit card or transaction information was accessed, the company said in a statement. Park Mobile doesn’t collect Social Security numbers, driver’s license numbers, or dates of birth, so that information couldn’t be breached, the company said.

Passwords were accessed, however, but the encryption key required to read them was not broken, the company said.

Park Mobile learned of the breach in late March, hired a cybersecurity firm to investigate and notified law enforcement. It posted an initial alert on its website about the breach on March 26.

This week, the company posted an update on its website advising users to consider changing their passwords on the app. To change a password, click here.

The breach involved third-party software used by Park Mobile and the vulnerability has since been eliminated, the company said.

Pittsburgh Parking Authority Executive Director Dave Onorato said the authority is seeking more information about the breach from Park Mobile.

“All we could do was issue a news release,” Onorato told the parking authority board Thursday. “This wasn’t isolated to Pittsburgh. We’re going to ask more specific questions.”

The Atlanta-based company’s app is used by 400 cities in North America and has more than 20 million users.

Pittsburgh Department of Mobility and Infrastructure Director Karina Ricks asked Onorato why the company waited until this week to ask users to change their passwords.

“It seems advising users sooner rather than later is a best practice,” Ricks said.

When he finds out more, Onorato told the board, he would provide an update.