Poshmark data compromised

[sunsetpainter]

Got this email this morning:

Dear Poshmark Community,

We recently discovered that data from some Poshmark users was acquired by an unauthorized third party.

The data acquired does not include any financial or physical address information, and we do not believe your password was compromised. Regardless, we recommend that you change your password as a precaution and security best practice.

The type of data involved includes:

Certain user profile information specified for public use such as username, first and last name, gender, and city
Certain internal account information such as email address, user ID, size preferences, and one-way encrypted passwords salted uniquely per user (making it nearly impossible to use these passwords to access an account), as well as social media profile information collected when users connect social media accounts to Poshmark
Certain internal Poshmark preferences for email and push notifications

We take the trust you have placed in us extremely seriously, and since learning of this incident, we’ve expanded our security measures even further. We’ve conducted an internal investigation, retained a leading security forensics firm, and have implemented enhanced security measures across all systems to help prevent this type of incident from happening in the future.

Poshmark is a platform built on love and transparency, and we’re committed to serving you, and our entire community, every step of the way. You are the core of our business, and without you, we wouldn’t be the community we are today. We sincerely regret any concern this may cause you, and we’re here to answer any questions you may have.

For more information, please visit:

support.poshmark.com/customer/portal/articles/security-notice or contact [e-mail].

Sincerely,

Team Posh

[val2525]

It was just a matter of time before someone hacked them. Welcome to the big time, Posh.

[chapeaunoir]

They're in the club!

[RetroMonde]

Swell. Yesterday Capital One, today Posh. My daughter sells there too and has been getting super weird email since last Thursday using an ancient email addy. Wonder if it's somehow related?

[chapeaunoir]

Probably not - you can purchase email addresses by the thousands - it's not a hack or anything, it's data mined and then sold in batches.

[kritter]

I just got this from Credit Karma..



In mid-2019, Poshmark had a data breach that could have impacted as many as 36 million users. Breached information might include usernames, passwords, names, genders, location and passwords. Even if you don't use your Poshmark account now, it's important to protect any info that was possibly exposed.

Your password was exposed in this breach, but we don't know what it is.


Stop using that password

Hackers might use the password from this breach to try to gain access to other accounts, so it's important to change it anywhere it's used.

If you don't know what the password is or where else you use it, start by making sure you have different passwords for any accounts with sensitive info — like your banking app, health insurance site, tax software, email account, etc.