HackingRetail & ConsumerRetailVulnerability ExploitStolen CredentialsData ExfiltratedCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Financial accountMediumResolved

Bombas

bd_e86dfbd599fe370a · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Aug 31, 2018

To disclose

—

Affected · nationwide

39,561252 in this filing

Linked

2 filings

Confidence

66%

Full breach record for Bombas →4 incidents on file

Bombas, LLC filed a supplemental notice with the NH AG regarding a 2014-2015 Magento vulnerability. Malicious code injected into the e-commerce platform exposed customer names, addresses, and credit card info. Total affected: ~39,561 (252 NH residents). Bombas is offering 24 months of credit monitoring via Kroll and has migrated to a new platform.

J jump to incidentP pin to compareR raw source

Incident timeline

Sep 27, 2014

Begins

Aug 31, 2018

Filed

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

California State AGbd_8eb047ffecafa64c2018-08-31Candidate

Name: Bombas
norm: bombas

Name: Bombas
norm: bombas
Industry: Retail & Consumerllm

Discovered: —
Breach occurred: Sep 27, 2014 – Feb 25, 2015
Materiality determined: —
Notification sent: Aug 31, 2018
Affected individuals: 39,561state + nationwide
Data types: Identity (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified the New Hampshire Attorney General's Office
Initial access: exploit_public_facing

During the incident: Offering all customers who are receiving notice credit monitoring and identity theft protection services through Kroll Information Assurance, LLC for a twenty-four (24) month period
Sending a letter to each of these 12 individuals for whom the window of exposure is February 10, 2015 to February 25, 2015
Engaged a trusted third-party service provider, Kroll, to provide you with more information
Changes made: Implemented additional security measures designed to prevent a recurrence of such an attack
Now runs on an entirely different e-commerce platform
Conducted a privacy and data security program review
Development or enhancement of policies and training on reasonable and appropriate security measures
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

California State AGAug 31 · first

New Hampshire State AGAug 31 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/bombas-20180831.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 31, 2018
Raw hash: beadf65f2e93081c0ca8344d88a6f9a997f76f0cfaf8226162f2e6d96ac7479b

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityBombas

Victim entityBombas

IncidentUnauthorized Access

Stated responseOffering all customers who are receiving notice credit monitoring and identity theft protection services through Kroll Information Assurance, LLC for a twenty-four (24) month period

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov