DisclosureLens
MalwareRetail & ConsumerRetailRansomwareData ExfiltratedCustomer Data InvolvedPIIFinancial accountIdentity (basic)MediumResolved

Bombas

bd_632c602d45662e4e · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 15, 2015

Filed

May 18, 2018

To disclose

41 months

Affected · nationwide

41,00090 in this filing

Linked

5 filings

Confidence

65%
Full breach record for Bombas4 incidents on file

Bombas, LLC notified customers of a data breach involving malware on its e-commerce platform. The malware existed from the site's launch on September 1, 2013, until removal on February 9, 2015. Approximately 41,000 customers who made credit card purchases during this period were affected. Data potentially included names, addresses, and credit card information. Bombas engaged Kroll to provide two years of free identity monitoring and migrated to a new platform.

Incident timeline

undetected · 501 days
discovery → filing · 41 months / 1219 days

Sep 1, 2013

Begins

Jan 15, 2015

Discovered

May 18, 2018

Filed

vs. sector median

+167 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Filing propagation · 5 filings · 5 states

View merged incident ↗
New Hampshire State AGMay 18 · first
Oregon State AGMay 18 · first
California State AGMay 18 · first
Montana State AGMay 18 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.