Question 1

Do I need to take any action?

Accepted Answer

If you have received an email, sms or push notification from us regarding an update on the cyberattack, the hashed version of the password that you created in our system was accessed. And although we use bcrypt, which is a widely recognised password hashing algorithm to protect the confidentiality of your password, we are taking a preemptive measure to encourage you to change your password on any other platform where you have used the same password. Another way of keeping your password secure and unique is through a password manager. There are various password managers available on the market and we suggest you choose the one that is most convenient for you.

Question 2

What does a hashed password mean?

Accepted Answer

Password hashing means converting a password through an algorithm to turn it into an unintelligible series of characters. This is to protect the confidentiality of the password and also protect it against any unauthorized use.

Question 3

How do I know if my hashed password was accessed?

Accepted Answer

Users whose hashed password version was part of the data breach will receive an email, sms or push notification from us. We encourage those users to change their password on any other platform where they have used the same password.

Question 4

What hashing algorithm was used to hash the passwords?

Accepted Answer

We use bcrypt, which is a widely recognised password hashing algorithm to protect the confidentiality of your password. Bcrypt automatically creates a random and unique salt, and embeds it in each password’s hash value. This approach adds complexity and computational intensity that increases the resilience of the hashed password against common password attacks.

Question 5

If the passwords were hashed, why do I need to change it?

Accepted Answer

Although the password is hashed by the widely recognised password hashing algorithm bcrypt, we took a preemptive measure to encourage you to change your password on any other platform where you have used the same password.

Question 6

Why are you not informing all affected customers?

Accepted Answer

We are reaching out to affected customers who created their own passwords, encouraging them to change their password on any other platform where they have used the same password. We reset the passwords for all affected customers on December 10 upon discovering the data breach as a part of our standard incident response.

Question 7

What has happened?

Accepted Answer

On December 10, 2023, we discovered we were the victim of a cyber attack. The attack resulted in a breach of non-sensitive customer data. We deeply care about our customers and want to make sure you are fully informed about this incident. Here is what we have done.

Check out the FAQ’s below or go to our support page if you have any questions.

Question 8

How do I know if I am impacted?

Accepted Answer

We have been informing all affected customers soon after we discovered we were a victim of a cyber attack through our app that links to our website. We continue to contact customers who have not seen the in-app message either via push notifications, email (
no-reply@hello.parkmobile.com
 or 
no-reply@hello.easypark.com
) or text. If you want to know if you are affected, please open the app.

Question 9

What actions have you taken?

Accepted Answer

We took swift measures to stop the cyber attack.
We made sure our services continued to operate as usual.
We notified the appropriate authorities.
We reset the passwords for all affected customers on December 10 upon discovering the data breach and as a part of our standard incident response.
Our security team, including external security experts, is working hard to ensure effective security and privacy measures are in place.

Question 10

What kind of data has been accessed?

Accepted Answer

Not all affected customers provided the same data to us. If you were affected, some contact information you may have provided to us (such as name, phone number, physical address, email address) were accessed. When you pay for parking, some digits of your debit or credit card of choice, if applicable, are displayed. These partial details were accessed. However, someone cannot make payments using this incomplete information. No combination of this stolen data can be used to perform payments.
Further, hashed versions of passwords were accessed; those users are being informed about this by separate email, push notification or SMS.

Question 11

Was my parking data accessed?

Accepted Answer

No parking data regarding your location, vehicle registration, or parking sessions was accessed in this data breach.

Question 12

How can you determine that my data that has been stolen, is considered "non-sensitive"?

Accepted Answer

We deeply care about our customers and take protecting your privacy seriously. The data that was accessed is not considered sensitive according to EU regulations. We understand that experiencing a data breach creates concern.
Here’s how the EU defines sensitive data: 
https://commission.europa.eu/law/law-topic/data-protection/reform/rules-business-and-organisations/legal-grounds-processing-data/sensitive-data/what-personal-data-considered-sensitive_en

Question 13

You say some digits of my debit or credit card have been accessed? What exactly has been accessed? And can it be used to make a payment?

Accepted Answer

Depending on your payment method, a few digits of your IBAN or credit card number are - if applicable - part of your information, and this partial data has been accessed. However, someone cannot make payments using this incomplete information. No combination of this stolen data can be used to perform payments. As always, you should be mindful of phishing attempts, which are unfortunately common.

Question 14

Did I pay for parking I did not do?

Accepted Answer

No, the incident did not result in unauthorized parking transactions.

Question 15

To which data protection authorities are you reporting this incident?

Accepted Answer

We have reported the incident to t
he Swedish data protection authority, which is the competent authority in this case because EasyPark's headquarters is based in Sweden. The authorities in the non-EU countries United Kingdom and Switzerland have also been notified.

Question 16

What emerged from Easypark's investigation into the hack?

Accepted Answer

The investigation is ongoing and therefore we cannot share any details due to the confidential nature of it. We will update affected customers as appropriate and we are continuously updating the FAQ on our website.

Question 17

Does Easypark regularly have ethical hackers look for vulnerabilities in the app and database to prevent you from being hacked?

Accepted Answer

Yes, security testing is performed by independent security experts as part of our continuous security program.

Question 18

Experts have said it is a data breach on the original Parkmobile platform. Is that right?

Accepted Answer

That is not accurate. The December attack targeted the EasyPark customer self service web portal, which is a separate system. It did not target the Parkmobile system.

Question 19

Users had to delete the old Parkmobile app. Why was that?

Accepted Answer

That is not correct. Users did not have to delete the Parkmobile app. Perhaps there is some confusion we can help clarify. EasyPark Group acquired Parkmobile/ParkNow in 2021 and recently rebranded the Dutch Parkmobile app: the name, icon and colors were changed to be in line with the EasyPark brand.

Question 20

There was also a data breach at Parkmobile in 2021. Has the same vulnerability been used again?

Accepted Answer

No. This incident is not associated with any Parkmobile system nor previous incident. The cyber attack on ParkMobile in the United States that occurred in 2021 did not affect any customers in The Netherlands nor any users outside of the United States, and it occurred before EasyPark acquired Parkmobile/ParkNow.

Question 21

Were measures taken at the time to prevent a new data breach?

Accepted Answer

Yes, measures were taken to prevent security incidents based on the previous attack against ParkMobile in the United States. To be clear, the December 2023 attack was not against any Parkmobile system.

EasyPark Data Breach

This is what happened

1. We took actions to protect you.

2. We are making you aware.

3. We are sorry.

Do you have any questions?