HackingStolen CredentialsData ExfiltratedCustomer Data InvolvedIDENTITY_BASICFINANCIAL_ACCOUNTLowContained
COMBE INCORPORATED
bd_6531a01ba6a6386f · schema v1 · pii pii-v1
Full breach record for COMBE INCORPORATED →Combe Incorporated notified California residents of a data breach occurring between March 2, 2020, and April 10, 2020. An unauthorized third party placed malicious code on the company's checkout page to collect customer data, including names, addresses, and credit card numbers. Combe removed the code, engaged forensic investigators, and notified credit card companies. No Social Security numbers were impacted.
California clockDiscovered Apr 10, 2020 → Notified Aug 28, 2020140d ✗ CA 60-day late20 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 2 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (1) · sorted by filing gap
- bd_60ad38cee8f4e399Montana State AGfiled 2020-08-26Candidate
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-193479
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Aug 26, 2020
- Raw hash
- 45d428283f6012b98ca13b8ef7eeda1e2971ae7689ae8f0d8305cc0613329cfe
Reporting entity
- Name
- COMBE INCORPORATEDnorm: combe
Victim entity
- Name
- COMBE INCORPORATEDnorm: combe
Incident
- Discovered
- Apr 10, 2020
- Materiality determined
- —
- Notification sent
- Aug 28, 2020
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICFINANCIAL_ACCOUNT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing Application
- Threat actor
- ExternalFinancial
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 20 weeks(138 days from discovery to filing)
- Compliance flags
- CA 60-day late · 140d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Apr 10, 2020→ Notified: Aug 28, 2020140d 60 days (analyst band, pre-2026 discoveries) CA 60-day late
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.