One linked filing — more sources may join as they report · filed Aug 31, 2018. View entity profile → Other incidents for this victim →
incident inc_ab2cc0dba0a24b4a · merge_method deterministic
Discovered → first regulatory filing
Not recorded for this incident
Discovery variance · Leak precedence · Materiality delta · SEC filing delay · Filing span — no leak-site claim in this cluster; no SEC 8-K in this cluster; needs two dated filings.
PII · Identity (basic) · Financial account
CA
all State AG
Earliest sighting first · deep chronology in Litigation Timeline
Sep 27, 2014 → Feb 25, 2015
When the intrusion reportedly occurred, per the linked filings
Feb 9, 2015
Reported by CALIFORNIA AG filing
Bombas LLC reported a historical data breach involving malicious code injected into its e-commerce website between September 2014 and February 2015. The incident potentially exposed customer names, addresses, and credit card information for purchases made between February 10 and February 25, 2015. Bombas engaged Kroll to provide two years of free identity monitoring and migrated to a new e-commerce platform.
About this clustering
DisclosureLens links filings into incidents through layered matchers: deterministic rules (same source document, multistate filings of one breach, tight-window same-victim pairs), a weighted-similarity scorer for cross-source candidates, and an operator review queue for everything uncertain. Each link records its own method and confidence — shown per filing in the timeline below. The system defaults to NOT merging when uncertain, because a false merge (collapsing two unrelated breaches) is more harmful than a false split (showing related filings separately); uncertain pairs route to human review instead of auto-merging. Filing summaries shown in the timeline are AI-generated extracts — verify each against its linked source.