Bosley data breach: what happened and what to do

Bosley, the hair restoration company, said malware hit its systems on August 17, 2020 and it learned of the unauthorized access on September 24. Maine's Attorney General lists 100,855 people affected. Names, Social Security numbers and financial account or card numbers were exposed.

View all 13,177 breaches

Breach date: 17 Aug 2020
Made public: 16 Jan 2021
Affected: 100,855
Data exposed: Names, Social security numbers, Bank account numbers, Credit cards
Last updated: 27 Oct 2026

Reviewed by Anthon Wansland

Head of Product & Co-Founder

Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.

What happened

Bosley, a hair restoration company, told customers that malware hit its systems on August 17, 2020 and that it learned of the unauthorized access on September 24, 2020. The California Attorney General hosts its notice, which says the intruder reached some systems holding customers' personal information.

Notification letters began in January 2021. The Maine Attorney General's filing lists 100,855 people affected in total.

Sources checked: oag.ca.gov, maine.gov, news.bloomberglaw.com

Last verified against the official page: 27 Oct 2026

How we research this Report an error

What was exposed

According to the Maine filing, the data included names, Social Security numbers and financial account or payment card numbers. A cosmetic clinic's customer files are personal on top of that: scammers can reference a real procedure to sound credible.

The company's response and the settlement

Bosley offered 12 months of TransUnion credit monitoring and identity restoration. A class action over the breach settled for $500,000, according to Bloomberg Law. The deadline to claim has passed.

What to do if you were in it

1

Freeze your credit at all three bureaus

A credit freeze is free and stops lenders from seeing your credit report, which blocks most new accounts in your name. Place it separately at Equifax, Experian and TransUnion, as the FTC explains.
2

Replace exposed cards and bank details

If your letter lists a card or bank account number, ask the issuer for a new number and review statements for charges you don't recognize.
3

Use the free monitoring if you were offered it

Bosley offered 12 months of TransUnion monitoring and identity restoration. The FTC recommends taking free credit monitoring when a company offers it. Monitoring alerts you to new activity but doesn't block it, so pair it with a freeze.
4

Check your credit reports and statements

Review your reports for free at annualcreditreport.com and read bank statements for charges you don't recognize. If someone uses your details, report it at IdentityTheft.gov to get a recovery plan.
5

Expect scams that mention the breach

Criminals use real details to sound convincing. Treat unexpected calls, texts or emails about this breach, your account or your health coverage as suspect, and contact the company on a number or site you look up yourself.
6

Check whether your email or phone is in this and other breaches

Run a free Serus scan. It checks breach databases for your email, phone and other details, and Serus keeps watching and alerts you if they turn up in a new leak.