Bombas bombas.com Bombas data breach: what happened and what to do
Bombas told customers that malicious code on its checkout may have been in place from November 11, 2016 and captured payment details. It was disclosed in 2020. Names, addresses and payment card information were exposed.
View all 13,177 breaches- Breach date
- 11 Nov 2016
- Data exposed
- Names, Physical addresses, Credit cards
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
Bombas, the sock and apparel retailer, notified customers in 2020 about a checkout attack that began years earlier. The company said its investigation indicated malicious code may have been inserted into its website as early as November 11, 2016. This kind of attack is called formjacking: the code copies what shoppers type into the payment form. Scheduled website updates on February 16, 2017 rendered the code useless.
California's Attorney General posted the breach notice on June 3, 2020. Washington's list also carries it, with 2,313 Washington residents, which is only one state's share. No total has been published.
Sources checked: idtheftcenter.org, oag.ca.gov, atg.wa.gov
Last verified against the official page:
What was exposed
Bombas said the data included names, addresses and payment card information from orders placed while the code was active. The company offered free credit monitoring.
This is separate from an earlier 2014 incident at Bombas that led to a $65,000 settlement with the New York Attorney General.
What that means for you
Card details captured years ago are most likely already expired or replaced, but check anyway. Names and addresses alone are mostly useful for targeted phishing and mail scams that look like order confirmations or refunds.
What to do if you were in it
- 1
Check old card statements
If you ordered from Bombas between November 2016 and February 2017, look over statements from that period and from now for charges you don't recognize. Report any to your card issuer.
- 2
Ask your card issuer about a new card
If you still use a card from that time, ask the issuer to replace it. Cards are protected by law against most unauthorized charges when you report them quickly.
- 3
Expect messages that mention the breach
Fake order confirmations and refund offers are the likeliest follow-up. Don't click links or call numbers in them. Go to the company's own website instead, as the FTC advises.
- 4
Report misuse
If someone uses your details, report it at IdentityTheft.gov to get a recovery plan.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan. It checks breach databases for your email, phone and other details, and Serus keeps watching and alerts you when they show up in a new leak.
Official filings
- California Attorney General , filed 18 May 2018
Timeline
-
The breach happened
-
Reported to the California Attorney General
Frequently asked
When did the Bombas breach happen?
Bombas said malicious code may have been in its checkout from November 11, 2016 until website updates on February 16, 2017. It was disclosed in 2020.
What was exposed?
Names, addresses and payment card information, per Bombas's notice.
How many people were affected?
No total has been published. Washington's list shows 2,313 residents of that state alone.
Is there a settlement?
A court approved a class action settlement against Bombas and Shopify, per Law Street Media. Check the settlement site for terms.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
