HackingRetail & ConsumerRetailVulnerability ExploitBackdoor / C2Supply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIdentity (basic)Financial accountLowActive

Bimba LLC

bd_7a3475b809390817 · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Apr 16, 2020

To disclose

—

Affected

944

Linked

3 filings

Confidence

66%

Full breach record for Bimba LLC →2 incidents on file

Bimba, LLC notified the NH AG of a security incident involving its third-party cloud service provider. An unauthorized user exploited a server vulnerability to insert malicious code, diverting e-commerce transaction data (names, addresses, credit card details) from Dec 24, 2019 to Mar 11, 2020. 944 individuals affected, including 15 NH residents. Bimba engaged forensic investigators and offered 1 year of Experian IdentityWorks.

J jump to incidentP pin to compareR raw source

Incident timeline

Dec 24, 2019

Begins

Apr 16, 2020

Filed

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Montana State AGbd_85238d21dea19fb92020-04-09 · +7dCandidate
Massachusetts State AGbd_c53b9239f58a4e5a2020-04-09 · +7dVerified

Name: Bimba LLC
norm: bimba
Domain: bimba.com

Name: Bimba LLC
norm: bimba
Domain: bimba.com
Industry: Retail & Consumerllm

Discovered: —
Breach occurred: Dec 24, 2019 – Mar 11, 2020
Materiality determined: —
Notification sent: Apr 15, 2020
Affected individuals: 944state + nationwide
Data types: Identity (basic)Financial account
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General Consumer Protection & Antitrust Bureau
Initial access: exploit_public_facing

During the incident: Engaged a cybersecurity and forensic firm to determine how the security incident occurred and the scope of such incident
Asked vendor for additional information to enable us to fully investigate the incident
Vendor took measures to contain and remediate the vulnerability
Working closely with payment card companies regarding this matter
Offering a complimentary one-year membership of Experian's IdentityWorks
Changes made: Conducting a thorough review of the potentially affected records
Creating and implementing additional security measures, internal controls, and safeguards
Making changes to existing policies and procedures designed to prevent a similar occurrence from happening again
Vendor monitoring the site daily
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Montana State AGApr 9 · first

Massachusetts State AGApr 9 · first

New Hampshire State AG+7d · this page

Pattern: first filing Apr 9 (MT), last Apr 16 (NH) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/bimba-20200416.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 16, 2020
Raw hash: 43d1907e21ea5126be5f773518d40fe1aea40be540638a38f0dcb9ec639fd2b2

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityBimba LLC

Victim entityBimba LLC

IncidentThird-Party / Supply Chain

Stated responseEngaged a cybersecurity and forensic firm to determine how the security incident occurred and the scope of such incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov