Every public data breach

Disclosed this week44On record26,355

44 disclosed this week · 26,355 on record

Bombas

Disclosed Jun 6, 201939,561 affectedSettled

Official notice

Card skimmer hit 39,561 customers, unnotified for 3 years; USD 65,000 NY AG penalty

On September 27, 2014 intruders inserted card-stealing code into Bombas' Magento storefront; Bombas found it that November but did not fully remove it until February 2015 and failed to notify 39,561 consumers for over three years. It paid USD 65,000 in penalties.

What is known

People affected39,561 (as reported by the organization)
DisclosedJun 6, 2019
DiscoveredDec 26, 2018
HappenedNov 11, 2016
AttackHacking
Data exposedPayment cardsNamesAddressesFinancial
SectorRetail · US
StatusSettled
Lawsuit or fineUSD 65,000 NY AG penalty (June 2019) (about $65K)

Sources

Official noticeoag.ca.gov
California Attorney General breach notice: Bombas
Official noticeatg.wa.gov
Washington Attorney General breach notice: Bombas
Official noticejustice.oregon.gov
Oregon DOJ breach notice: Bombas
Regulatorag.ny.gov
NY AG: USD 65,000 settlement with Bombas
Official noticein.gov
Indiana Attorney General 2020 data breach report: Bombas
Official noticemaine.gov
Maine Attorney General breach notice archive: Bombas

Notices filed

TotalJun 6, 2019
Research39,561 people
Residents of CAJun 3, 2020
California AGCount not stated
Residents of WAJun 3, 2020
Washington AG2,313 people
Residents of ORJun 3, 2020
Oregon DOJ83,000 people
Residents of INJun 3, 2020
Indiana AG1,728 people
Residents of MEJun 3, 2020
Maine AG488 people

Other breaches at Bombas

Breach, details not statedExposed names, payment cards, financial details and passwords. Reported to the California AG.41K affectedRetailUSMay 18, 2018
History of this record
data_types2026-09-25
["payment-card","names","addresses"] to ["payment-card","names","addresses","financial"]by backfillSource
source2026-09-25
empty to https://www.in.gov/attorneygeneral/consumer-protection-division/id-theft-prevention/files/DB-Year-to-Date-Report-2020.pdfby backfillSource
status2026-09-25
confirmed to settledby seedSource
fine_usd2026-09-25
empty to 65000by seedSource
lawsuit2026-09-25
empty to USD 65,000 NY AG penalty (June 2019)by seedSource
sector2026-09-25
other to retailby seedSource
data_types2026-09-25
[] to ["payment-card","names","addresses"]by seedSource
records_basis2026-09-25
empty to organizationby seedSource
records2026-09-25
empty to 39561by seedSource
disclosed2026-09-25
2020-06-03 to 2019-06-06by seedSource
summary2026-09-25
empty to On September 27, 2014 intruders inserted card-stealing code into Bombas' Magento storefront; Bombas found it that November but did not fully remove it until February 2015 and failed to notify 39,561 consumers for over three years. It paid Uby seedSource
title2026-09-25
empty to Card skimmer hit 39,561 customers, unnotified for 3 years; USD 65,000 NY AG penaltyby seedSource
attack2026-09-25
unknown to hackingby backfillSource
discovered2026-09-25
empty to 2018-12-26by backfillSource
Added2026-09-25
First recordedby backfillSource

First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.

Everything about Bombas