Poshmark Data Breach (2018): What Was Exposed & What To Do

In May 2018, Poshmark reported a data breach that affected 36.4 million user accounts. The incident exposed email addresses, names, usernames, genders, geographic locations, and passwords stored as bcrypt hashes. The breach was publicly noted on May 16, 2018, and occurred in mid-2018. No further details on the method of intrusion, duration of access, or specific files involved have been disclosed in available reports.

Breaking down the breach

Public records state that the compromise involved 36.4 million accounts on the Poshmark platform. The data types listed as exposed are limited to email addresses, names, usernames, genders, geographic locations, and passwords stored as bcrypt hashes. Information on how the data was obtained, whether it was later distributed, or any response timeline beyond the reporting date remains undisclosed.

How a breach like this happens

Incidents involving the extraction of user account data from online platforms commonly result from unauthorized access to backend databases. This can occur through exploitation of application vulnerabilities, use of stolen administrative credentials, or misconfigured storage systems. Once access is gained, attackers may copy large volumes of records before detection, after which the data may appear in public or private listings.

Who is Poshmark?

Poshmark operates an online marketplace focused on peer-to-peer sales of clothing, accessories, and related goods. Platforms of this type maintain accounts that include contact details, location information, and authentication data to support transactions and user profiles. A breach at such a service can affect a large number of individuals because these sites often hold records for millions of registered users who interact regularly with the platform.

The information in question

The reported breach exposed email addresses, names, usernames, genders, geographic locations, and passwords stored as bcrypt hashes. No additional categories of data have been confirmed in public statements about this incident. Organizations in the social commerce sector routinely collect similar fields to enable account creation, location-based features, and login processes, though the precise contents of any extracted records from this event are not further detailed beyond the listed items.

What's at stake

Exposure of email addresses and usernames can facilitate phishing attempts or account enumeration on other services. Geographic locations and gender data add context that may be used for more targeted unsolicited contact. Passwords stored as bcrypt hashes require computational effort to attempt recovery, yet remain a concern for users who reuse credentials across sites. For the organization, the incident adds to records of platform security events that users and regulators may review when assessing data-handling practices.

If your data was in this breach

Individuals can review their account activity on Poshmark and any other services that use the same email or username. Changing passwords on affected accounts and enabling any available multi-factor authentication options are standard initial measures. Readers can also run a free exposure scan of their email address to check whether their information appears in known breach data sets.

AICompiled with AI assistance from public sources and published under our editorial standards.