HackingRetail & ConsumerRetailVulnerability ExploitZero-DayData ExfiltratedSupply Chain (3P Vendor)Customer Data InvolvedGovernment IDIdentity (basic)MediumContained

BIMBO BAKERIES USA, INC.

bd_8b8a3d993cb8884c · schema v1 · pii pii-v2

Severity

Medium

Discovered

Dec 6, 2025

Filed

Sep 4, 2026

To disclose

39 weeks

Affected

Not disclosed

Confidence

65%

Full breach record for BIMBO BAKERIES USA, INC. →4 incidents on file

Bimbo Bakeries USA reported a data breach involving a zero-day vulnerability in Oracle's E-Business Suite. Unauthorized parties accessed files containing names and Social Security Numbers. The incident was discovered on December 6, 2025, and notifications were sent on August 31, 2026. Affected individuals were offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

California clockDiscovered Dec 6, 2025 → Notified Aug 31, 2026268d ✗ CA 60-day late39 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 119 days

discovery → filing · 39 weeks / 272 days

Aug 9, 2025

Begins

Dec 6, 2025

Discovered

Sep 4, 2026

Filed

vs. sector median

+31 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: BIMBO BAKERIES USA, INC.
norm: bimbo bakeries usa

Name: BIMBO BAKERIES USA, INC.
norm: bimbo bakeries usa
Industry: Retail & Consumerllm

Discovered: Dec 6, 2025
Breach occurred: Aug 9, 2025
Undetected for: 119 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 31, 2026
Affected individuals: Not disclosed
Data types: Government IDIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1486 Data Encrypted for Impact
Threat actor: External
Initial access: exploit_public_facing

During the incident: Applied patches provided by Oracle to address the vulnerability
Launched an investigation
Launched a comprehensive review to determine the contents of the files involved
Re-evaluating our vendor relationships
Offered 12 months of complimentary credit monitoring through Cyberscout (a TransUnion company)
Changes made: Re-evaluating our vendor relationships
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 39 weeks(272 days from discovery to filing)
Compliance flags: CA 60-day late · 268dCA AG copy ≤15d · 4d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Dec 6, 2025
→ Notified: Aug 31, 2026
268d 60 days (analyst band, pre-2026 discoveries) CA 60-day late
California
Consumers notified: Aug 31, 2026
→ AG copy submitted: Sep 4, 2026
4d 15 calendar days CA AG copy ≤15d

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Dec 6, 2025 → Notified: Aug 31, 2026	268d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late
California	Consumers notified: Aug 31, 2026 → AG copy submitted: Sep 4, 2026	4d	15 calendar days	CA AG copy ≤15d

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-629294
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 4, 2026
Raw hash: cedf949b6bf143ecbb10000bfad1adbce70206478fc47452b4b05666a0ca4d2b

Reporting entityBIMBO BAKERIES USA, INC.

Victim entityBIMBO BAKERIES USA, INC.

Incidentdiscovered Dec 6, 2025

Stated responseApplied patches provided by Oracle to address the vulnerability

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov