HackingManufacturingManufacturingStolen CredentialsSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIdentity (basic)Financial accountLowActive

Bimba LLC

bd_85238d21dea19fb9 · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Apr 9, 2020

To disclose

—

Affected

5state residents only

Linked

4 filings

Confidence

66%

Full breach record for Bimba LLC →2 incidents on file

Bimba LLC notified Montana residents of a data security incident involving its third-party cloud service provider. An unauthorized user accessed e-commerce transaction data (names, addresses, credit card info) between Dec 24, 2019, and Mar 11, 2020. Bimba engaged forensic investigators and offered one year of Experian IdentityWorks.

J jump to incidentP pin to compareR raw source

Incident timeline

Dec 24, 2019

Begins

Apr 9, 2020

Filed

This filing is one of 4 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_c53b9239f58a4e5a2020-04-09Verified
Indiana State AGbd_9086f8b933e6562d2020-04-15 · +6dVerified
New Hampshire State AGbd_7a3475b8093908172020-04-16 · +7dVerified

Name: Bimba LLC
norm: bimba
Domain: bimba.com

Name: Bimba LLC
norm: bimba
Domain: bimba.com
Industry: Manufacturingllm

Discovered: —
Breach occurred: Dec 24, 2019 – Mar 11, 2020
Materiality determined: —
Notification sent: Apr 15, 2020
Affected individuals: 5state-resident count only
Data types: Identity (basic)Financial account
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Engaged a cybersecurity and forensic firm to determine how the security incident occurred and the scope of such incident
Asked vendor for additional information to enable us to fully investigate the incident
Offering you a complimentary one-year membership of Experian’s IdentityWorks
Changes made: Continue to create and implement additional security measures, internal controls, and safeguards
Make changes to existing policies and procedures designed to prevent a similar occurrence from happening again
Working closely with payment card companies regarding this matter
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Massachusetts State AGApr 9 · first

Montana State AGApr 9 · first · this page

Indiana State AG+6d

New Hampshire State AG+7d

Pattern: first filing Apr 9 (MA), last Apr 16 (NH) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Breach-NotificationDetails-152.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 9, 2020
Raw hash: 78bd3423b30e72d98ec986c98b4d94cf61e4a5b8928de8ae919c61d703d55833

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityBimba LLC

Victim entityBimba LLC

IncidentThird-Party / Supply Chain

Stated responseEngaged a cybersecurity and forensic firm to determine how the security incident occurred and the scope of such incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov