ParkMobile pays… $1 each for 2021 data breach that hit 22 million

ParkMobile has finally wrapped up a class action lawsuit over the platform’s 2021 data breach that hit 22 million users.

But there’s a catch: victims are receiving compensation in the form of a $1 in-app credit, which they must claim manually. And, it comes with an expiration date.

In-app $0.25 credit can be used 4 times!

Great news! If you were affected by ParkMobile’s 2021 data breach, there’s serious money to be made: a whopping dollar.

The popular mobile and web parking payments platform, headquartered in Atlanta, began sending emails last week to class action plaintiffs, advising them on how to claim their portion of the settlement fund.

Upon receiving this email, I was, like many others, understandably skeptical and struggled with its wording. Was it legitimate or a trolling (or even phishing) attempt?

The settlement follows a class action lawsuit accusing ParkMobile of failing to adequately protect user data compromised during the 2021 incident.

Account information of almost 22 million ParkMobile customers was stolen by threat actors at the time, who then leaked the full database on a hacking forum, letting anyone download it all.

This 4.5 GB data dump, released as a massive CSV text file, contained customers’ first and last names, initials, mobile numbers, email addresses, user names, bcrypt-hashed passwords, mailing addresses, license plate numbers, and vehicle information.

By December 2024, the years-long lawsuit filed in the US District Court for the Northern District of Georgia, Atlanta Division, resulted in a $32.8 million compensation amount.

As expected, the company denied any wrongdoing as part of the settlement—a standard legal clause commonly seen in such agreements:

“The lawsuit asserts common law and statutory claims against ParkMobile for alleged negligent data security practices, statutory claims, and declaratory judgment. ParkMobile denies all claims alleged against it and denies all charges of wrongdoing or liability. The settlement is not an admission of wrongdoing or an indication that ParkMobile has violated any laws, but rather the resolution of disputed claims.”

Affected users were urged to submit a claim form to law firms Baker et al., who represented the class of plaintiffs by March 5th, 2025.

Those who did not submit the forms, however, received “a code via email from ParkMobile to receive a $1.00 credit to your ParkMobile App” starting last week.

“You are eligible for up to a $1.00 credit to be applied to ParkMobile’s service fees,” states the email seen by BleepingComputer.

“The code provides a $0.25 discount on ParkMobile’s service fees and may be used up to four times for a total discount of $1.00.”

Special promo code… has an expiration

It gets better. The credit isn’t automatic. You need to manually apply a special promo code, P@rkMobile-$1, and add it to your account under Payment→Discounts before starting a session.

For most users, the code expires October 8, 2026, so hurry!

Residents of the Golden State of California, however, are lucky: the code doesn’t expire for them.

“The code will only work for accounts associated with email addresses that are in the class,” states the email, and can be used towards your next transaction, but not Reservations.

Those who have used ParkMobile in the past can check if their information was compromised in the 2021 data breach at HaveIBeenPwned by entering their email address associated with ParkMobile. As for those who weren’t affected, too bad, you missed out on a dollar.

Seriously, though, steer clear of phishing attempts!

Following the settlement news, ParkMobile is warning users of ongoing SMS phishing (smishing) attacks this week targeting its customer base.

“The SMS message appears to come from ParkMobile and includes instructions to click a link and pay the phony balance online,” states the company.

“This is a fraudulent message and is not from ParkMobile – do not proceed.”

ParkMobile reminds users that it will never ask customers for sensitive information like passwords, security codes, or ask them to share banking information, transfer funds, or download another app or service.

“We urge all our customers to stay vigilant. If something feels wrong – always check the sender. Our cybersecurity team are working to take down the fraudulent webpage and identify those responsible.”

Users should be wary of unsolicited communications appearing to originate from ParkMobile and refrain from scanning QR codes in these messages or in public spaces, for example, that may attempt to drive users to lookalike websites and apps, which are part of a phishing operation or scam.

Join the Breach and Attack Simulation Summit and experience the future of security validation. Hear from top experts and see how AI-powered BAS is transforming breach and attack simulation.

Don’t miss the event that will shape the future of your security strategy

Register Now