Question 1

Do I need to take any action?

Accepted Answer

If you have received an email, sms or push notification from us regarding an update on the cyberattack, the hashed version of the password that you created on our self-service-portal was accessed. And although we use bcrypt, which is a widely recognised password hashing algorithm to protect the confidentiality of your password, we are taking a preemptive measure to encourage you to change your password on any other platform where you have used the same password. Another way of keeping your password secure and unique is through a password manager. There are various password managers available on the market and we suggest you choose the one that is most convenient for you.

Question 2

What does a hashed password mean?

Accepted Answer

Password hashing means converting a password through an algorithm to turn it into an unintelligible series of characters. This is to protect the confidentiality of the password and also protect it against any unauthorized use.

Question 3

How do I know if my hashed password was accessed?

Accepted Answer

Users whose hashed password version was part of the data breach will receive an email, sms or push notification from us. We encourage those users to change their password on any other platform where they have used the same password.

Question 4

What hashing algorithm was used to hash the passwords?

Accepted Answer

We use bcrypt, which is a widely recognised password hashing algorithm to protect the confidentiality of your password. Bcrypt automatically creates a random and unique salt, and embeds it in each password’s hash value. This approach adds complexity and computational intensity that increases the resilience of the hashed password against common password attacks.

Question 5

If the passwords were hashed, why do I need to change it?

Accepted Answer

Although the password is hashed by the widely recognised password hashing algorithm bcrypt, we took a preemptive measure to encourage you to change your password on any other platform where you have used the same password.

Question 6

Why are you not informing all affected customers?

Accepted Answer

We are reaching out to affected customers who created their own passwords, encouraging them to change their password on any other platform where they have used the same password. We reset the passwords for all affected customers on December 10 upon discovering the data breach as a part of our standard incident response.

Question 7

What has happened?

Accepted Answer

On December 10, 2023, we discovered we were the victim of a cyber attack. The attack resulted in a breach of non-sensitive data, but did not impact our services. We took swift measures to stop the cyber attack and have notified the appropriate authorities. We are reaching out to affected customers.

Question 8

How do I know if I am impacted?

Accepted Answer

We have been informing all affected customers soon after we discovered we were a victim of a cyber attack through our app that links to our website. We continue to contact customers who have not seen the in-app message either via push notifications, email (
no-reply@hello.easypark.net
)
 or text. If you want to know if you are affected, please open the app.

Question 9

Should I delete or change my account profile?

Accepted Answer

No, there is no need for you to delete or change your account profile.

Question 10

What actions have you taken?

Accepted Answer

We took swift measures to stop the cyber attack.
We made sure our services continued to operate as usual.
We notified the appropriate authorities.
We reset the passwords for all affected customers on December 10 upon discovering the data breach and as a part of our standard incident response.
Our security team, including external security experts, is working hard to ensure effective security and privacy measures are in place.

Question 11

What kind of data has been accessed?

Accepted Answer

Not all affected customers provided the same data to us. If you were affected, some contact information you may have provided to us (such as name, phone number, physical address, email address) were accessed. When you pay for parking, some digits of your debit or credit card of choice, if applicable, are displayed. These partial details were accessed. However, someone cannot make payments using this incomplete information. No combination of this stolen data can be used to perform payments. Further, hashed versions of passwords were accessed; those users are being informed about this by separate email, push notification or SMS.

Question 12

Was my parking data accessed?

Accepted Answer

No parking data regarding your location, vehicle registration, or parking sessions was accessed in this data breach.

Question 13

How can you determine that my data that has been stolen, is considered "non-sensitive"?

Accepted Answer

We deeply care about our customers and take protecting your privacy seriously. The data that was accessed is not considered sensitive according to EU regulations. We understand that experiencing a data breach creates concern.
Here’s how the EU defines sensitive data: 
https://commission.europa.eu/law/law-topic/data-protection/reform/rules-business-and-organisations/legal-grounds-processing-data/sensitive-data/what-personal-data-considered-sensitive_en

Question 14

You say some digits of my debit or credit card have been accessed? What exactly has been accessed? And can it be used to make a payment?

Accepted Answer

When you pay for parking, some digits of your debit or credit card of choice are displayed. These partial details were accessed. However, someone cannot make payments using this incomplete information. No combination of this stolen data can be used to perform payments. As always, you should be mindful of phishing attempts, which are unfortunately common

Question 15

Did I pay for parking I did not do?

Accepted Answer

No, the incident did not result in unauthorized parking transactions.

Question 16

To which data protection authorities are you reporting this incident?

Accepted Answer

We have reported the incident to t
he Swedish data protection authority, which is the competent authority in this case because EasyPark's headquarters is based in Sweden. The authorities in the non-EU countries United Kingdom and Switzerland have also been notified.

EasyPark Data Breach

1. We took actions to protect you.

2. We are making you aware.

3. We are sorry.

Do you have any questions?