MalwareRetail & ConsumerRetailInfostealerData ExfiltratedCustomer Data InvolvedDelayed DiscoveryPIIIdentity (basic)Financial accountMediumResolved

Bombas

bd_f50804e00f830456 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Dec 26, 2018

Filed

Jun 3, 2020

To disclose

18 months

Affected

2,313state residents only

Linked

7 filings

Confidence

71%

Full breach record for Bombas →4 incidents on file

Bombas LLC notified Washington AG of a security incident where malicious code on its Shopify e-commerce platform may have scraped customer PII and payment card data between Nov 11, 2016 and Feb 16, 2017. Discovered Dec 26, 2018 via Braintree report. 2,313 WA residents affected. Notifications mailed June 3, 2020.

J jump to incidentP pin to compareR raw source

Washington clock✗ WA AG >90d18 months discovery → filing

Incident timeline

undetected · 775 days

discovery → filing · 18 months / 525 days

Nov 11, 2016

Begins

Dec 26, 2018

Discovered

Jun 3, 2020

Filed

vs. sector median

+68 wks slower

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Montana State AGbd_032c860efe4a2ff32020-06-03Candidate
New Hampshire State AGbd_2e0f55b86f1170a32020-06-03Verified
Oregon State AGbd_2f92b42d2848b3ab2020-06-03Verified
California State AGbd_9101cc153fd11ef12020-06-03Verified

Show 2 more filings ↓up to 1d gap

Indiana State AGbd_9b29684e29b93fe12020-06-03Verified
Massachusetts State AGbd_43c63091f0426d8f2020-06-04 · +1dVerified

Name: ROPES & GRAY LLP
norm: ropes gray

Name: Bombas
norm: bombas
Industry: Retail & Consumerllm

Discovered: Dec 26, 2018
Breach occurred: Nov 11, 2016 – Feb 16, 2017
Undetected for: 775 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 3, 2020
Affected individuals: 2,313state-resident count only
Data types: PIIIdentity (basic)Financial account
Data elements: NameFinancial account number
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 500+dexposure 1-99d
WA-stated discovery: Found after the fact
Attack vector: Unknown
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Notified Washington Attorney General
Initial access: exploit_public_facing

During the incident: Engaged Stroz Friedberg to assist with the investigation
Retained Ropes & Gray as legal counsel
Made arrangements for potentially affected customers to receive two years of credit monitoring at no cost
Changes made: Added security feature to e-commerce platform to prevent malicious code attacks
Investments in people, processes, and technologies for comprehensive information security program
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 18 months(525 days from discovery to filing)
Compliance flags: WA AG >90d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

Montana State AGJun 3 · first

New Hampshire State AGJun 3 · first

Oregon State AGJun 3 · first

California State AGJun 3 · first

Indiana State AGJun 3 · first

Washington State AGJun 3 · first · this page

Massachusetts State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10555.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 3, 2020
Raw hash: d8b245c857eb1712980e20b9c81d34b31d4361e9269890fbdd1e7b6ba92749c3

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityROPES & GRAY LLP

Victim entityBombas

Incidentdiscovered Dec 26, 2018

Stated responseEngaged Stroz Friedberg to assist with the investigation

ComplianceWA AG >90d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com