The digital parking payment app ParkMobile has agreed to a $32.8 million settlement after a 2021 data breach exposed the information of more than 20 million users.
A proposed class action suit was first filed in Georgia federal court on May 25, 2021, two months after the company initially announced the leak. The suit was filed on behalf of Tyler Baker and "all others similarly situated," and alleged that Baker had experienced "abnormal activity" in his PayPal account linked to ParkMobile and had been forced to spend "valuable time" mitigating these activities, changing passwords and monitoring the account.
ParkMobile was accused of harming impacted consumers long-term by failing to secure their data and therefore exposing them to identity theft, fraud and the need to spend time securing related accounts.
As with any settlement, ParkMobile's agreement to pay does not mean they admitted to wrongdoing, but rather that involved parties decided this was a better course of action than a lengthy trial process. Even so, millions are now up for grabs.
Here's how to claim your compensation in the ParkMobile data breach settlement.
Don't fall for this: The fake QR code scam that aims to take your money at parking meters
2021 ParkMobile data breach
ParkMobile is a mobile and web app that allows users to pay for parking digitally. It was launched in the U.S. in 2009 and has since built out other services, including a parking reservation system, a self-service management platform for parking location owners and operators and integration with Google Maps.
In March 2021, the company announced that it had experienced a "cybersecurity incident linked to a vulnerability in a third-party software." A later lawsuit lodged against the company indicated that the data of roughly 21 million users was compromised.
ParkMobile said in subsequent updates that "sensitive data” information like payment card numbers had not been leaked and users' encrypted passwords were accessed but not the encryption keys needed to read them.
The lawsuit said leaked information included license plate numbers, email addresses, phone numbers, vehicle nicknames and, in a small number of cases, mailing addresses.
Court documents accused ParkMobile of ignoring deficiencies in its security systems, failing to follow industry guidelines and failing to adopt security measures recommended by experts in the field, including the Federal Communications Commission.
In a statement posted to its website Nov. 15, ParkMobile said that it immediately launched an investigation following the incident and "quickly eliminated a third-party vulnerability."