Hackers compromised parking payment app used at popular Houston destinations

Following the hacking of parking payment app ParkMobile in March, company leadership announced the company has completed an investigation and no credit card information was accessed.

The Atlanta-based company serves hundreds of U.S. cities and operates under the name ParkHouston in Houston. According to an internal investigation, ParkHouston was among the providers that was hacked. ParkMobile issued an update about the hacking April 15 and an additional notification to users in an email message May 24.

ParkHouston serves parking spaces throughout the city including in Downtown, East Downtown, Washington Avenue and at major event venues such as Minute Maid Park, The Toyota Center, Revention Music Center, BBVA Stadium and NRG Stadium.

In the company investigation’s findings, no users’ credit card information or information about users’ parking history was accessed. The security breach gave hackers access to license plate numbers, email addresses and phone numbers as well as vehicle nicknames that some users add to profiles. A “small percentage” of users’ mailing addresses was also accessed, according to a statement from ParkMobile.

ParkMobile does not collect or store social security numbers or dates of birth, the company noted.

In response, the ParkMobile statement reminded users to use unique passwords for the app. Passwords can be changed in the app’s settings tab, the statement read. No passwords were accessed through the breach.

The hacking, which accessed a third-party software used by ParkMobile, exposed vulnerabilities in the app’s system.

“We quickly eliminated the third-party vulnerability, and we continue to maintain our security and monitor our systems,” the statement read. “Out of an abundance of caution, we also notified the appropriate law enforcement authorities.”

Other cities affected by the data breach include Columbus, Ohio; Louisville, Kentucky; Fort Worth, Texas; Charlotte, North Carolina and New York, New York.

In an email to Community Impact Newspaper, a ParkMobile spokesperson confirmed over 20 million accounts were compromised nationwide although any account created after March 17, 2021 was no affected. ParkMobile is working with a cybersecurity firm to monitor the app's systems.