Breach Disclosure: Poshmark

On August, 2019, the online marketplace for buying and selling clothes Poshmark was the victim of a data breach. The details of the breach were published by Tech Crunch and announced in the official web page's forum, claiming that the data leaked consisted of email addresses, names, usernames, genders, locations and passwords stored as bcrypt hashes of nearly 36 million users.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
Remain alert to potential spear phishing attacks through email and social media

Details

As declared in Poshmark official publication the data from the breach did not contain any financial or physical address details, stating also that passwords should not be compromised due to the level of encryption. Poshmark has a 50 million user base, meaning that the data breach exposed more than half of their entire user base information.