Bombas
Disclosed May 18, 20188 years ago41,000 affectedConfirmed
What is known
| People affected | 41,000 (as reported by the organization) |
|---|---|
| Disclosed | May 18, 2018 |
| Discovered | Dec 31, 2014 |
| Happened | Sep 27, 2014 |
| Attack | Not stated |
| Data exposed | Names, Payment cards, Financial, Passwords |
| Sector | Retail · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: Bombasoag.ca.gov · Official notice | Official notice |
| Oregon DOJ breach notice: Bombasjustice.oregon.gov · Official notice | Official notice |
| Indiana Attorney General 2018 data breach report: Bombasin.gov · Official notice | Official notice |
| Maine Attorney General breach notice archive: Bombasmaine.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| California AGresidents of CA | May 18, 2018 | |
| Oregon DOJresidents of OR | May 18, 2018 | 41,000 |
| Indiana AGresidents of IN | May 21, 2018 | 771 |
| California AGresidents of CA | Aug 31, 2018 | |
| Maine AGresidents of ME | Aug 31, 2018 | 175 |
Other breaches at Bombas
| Breach | Affected | ||||
|---|---|---|---|---|---|
| Card skimmer hit 39,561 customers, unnotified for 3 years; USD 65,000 NY AG penaltyJun 6, 20197 years agoHacking | Jun 6, 20197 years ago | Hacking | Retail | Settled | 40K |
History of this record
- 2026-09-25 · data_types: [] to ["names","payment-card","financial","passwords"] · backfill source
- 2026-09-25 · sector: other to retail · backfill source
- 2026-09-25 · records_basis: empty to organization · backfill source
- 2026-09-25 · records: empty to 41000 · backfill source
- 2026-09-25 · discovered: empty to 2014-12-31 · backfill source
- 2026-09-25 · disclosed: 2018-08-31 to 2018-05-18 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.