Learn from the Latest Parking Industry Data Breach

The Parking Industry continues to introduce new and innovate solutions to satisfy the requirements of operational efficiencies and enhanced customer service.  These innovations may come with a price when it comes to privacy and the risk of data loss.  Whenever a choice has been made to collect data, it is critical to determine the need, the benefit, and the impact of collecting and storing that data.  Parking companies like Park ‘N Fly Canada is unfortunately falling pray to cyber criminals and losing, in this case, a million customers’ personal data.

Park ‘N Fly is not the only parking company that have privacy and security incidents in 2023-2024, just the latest.  What this shows is that like other industries, Parking, is not immune to data privacy and security issues.  What we should be doing is learning from these incidents so that the industry, as a whole matures as it pertains to security and privacy.

So, what can we learn from this incident?  The catalyst to the breach was stolen VPN credentials.  Although the reason for the stolen credentials was not publicized, most credentials are stolen because of social engineering and/or poor password practices.  Proper employee training on topics of social engineering tactics like phishing and smishing and enforcing security standards like password practices, password configuration and enforcement of multifactor authentication can help decrease the risk of data loss due to loss of credentials.

Park ‘N Fly breach affected a large number of customers. This total number of customers impacted makes this a reportable event which required not just regulatory reporting but also consumer reporting.  It is critical to have a comprehensive incident response plan in place.

I am sure there are many other lessons that can be learned from this latest breach.  However, the most important thing to take away is that parking operators, municipalities, and  development companies need to have privacy and security practices in place to reduce their risk of a data breach.