HackingRetail & ConsumerRetailStolen CredentialsData ExfiltratedCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Financial accountLowContained

Bombas

bd_2e0f55b86f1170a3 · schema v1 · pii pii-v1

Severity

Low

Discovered

Nov 11, 2019

Filed

Jun 3, 2020

To disclose

29 weeks

Affected

680state residents only

Linked

7 filings

Confidence

66%

Full breach record for Bombas →4 incidents on file

Bombas, LLC notified the NH AG of a security incident where malicious code on its Shopify e-commerce platform may have scraped customer data (names, addresses, payment card info) between Nov 11, 2016 and Feb 16, 2017. Approximately 680 NH residents affected. Bombas engaged Stroz Friedberg for investigation and offered 2 years of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 1095 days

discovery → filing · 29 weeks / 205 days

Nov 11, 2016

Begins

Nov 11, 2019

Discovered

Jun 3, 2020

Filed

vs. sector median

+22 wks slower

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Montana State AGbd_032c860efe4a2ff32020-06-03Candidate
Oregon State AGbd_2f92b42d2848b3ab2020-06-03Verified
California State AGbd_9101cc153fd11ef12020-06-03Verified
Indiana State AGbd_9b29684e29b93fe12020-06-03Verified

Show 2 more filings ↓up to 1d gap

Washington State AGbd_f50804e00f8304562020-06-03Verified
Massachusetts State AGbd_43c63091f0426d8f2020-06-04 · +1dVerified

Name: Bombas
norm: bombas

Name: Bombas
norm: bombas
Industry: Retail & Consumerllm

Discovered: Nov 11, 2019
Breach occurred: Nov 11, 2016 – Feb 16, 2017
Undetected for: 1,095 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 3, 2020
Affected individuals: 680state-resident count only
Data types: Identity (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1056 Input CaptureT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General
Initial access: exploit_public_facing

During the incident: Engaged Stroz Friedberg to assist with the investigation
Retained Ropes & Gray as legal counsel
Made arrangements for potentially affected customers to receive two years of credit monitoring at no cost to them
Investments in the people, processes, and technologies that drive its comprehensive information security program
Changes made: Added a security feature to the e-commerce platform on February 16, 2017 that would prevent malicious code attacks
Taken other steps in recent years to further improve security and prevent similar incidents from happening in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 29 weeks(205 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

Montana State AGJun 3 · first

Oregon State AGJun 3 · first

California State AGJun 3 · first

Indiana State AGJun 3 · first

Washington State AGJun 3 · first

New Hampshire State AGJun 3 · first · this page

Massachusetts State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/bombas-20200603.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 3, 2020
Raw hash: 192ec04873a7bbf22d3ddfcd39b136c376e689b6c94608a9ccd9cfe9d616f69a

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityBombas

Victim entityBombas

Incidentdiscovered Nov 11, 2019

Stated responseEngaged Stroz Friedberg to assist with the investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov