Malware in the code of the e-commerce platform was identified and initially removed from their website. They cannot determine which transactions were impacted. They have been sending this notice to all of the approximately 41,000 customers who made a credit card purchase on our website during the period the malware may have existed until the day the identified malware was finally removed.

The California Office of the Attorney General reported a data breach involving Bombas LLC on June 3, 2020. The breach occurred between November 11, 2016, and February 16, 2017, potentially exposing customers' names, addresses, and payment card data. The specific number of individuals affected is unknown.

The California Office of the Attorney General disclosed a data breach affecting Bombas LLC, a direct-to-consumer apparel company. The incident occurred between September 27, 2014, and February 25, 2015, but was only reported on August 31, 2018. The breach exposed personal customer data, including names, addresses, and credit card information, though the exact number of affected individuals remains undisclosed (labeled as 'UNKN' in reports).The compromised data suggests a financial and reputational risk, as payment details were accessed, potentially enabling fraudulent transactions or identity theft. While the breach did not involve ransomware or a full-scale system takeover, the prolonged exposure period (nearly five months) raises concerns about the company’s cybersecurity posture at the time. Customers were notified years after the initial compromise, further amplifying reputational damage due to delayed transparency.The incident aligns with patterns seen in e-commerce data breaches, where third-party vulnerabilities or insufficient safeguards lead to unauthorized access. No evidence suggests the attack escalated to operational disruptions or broader systemic threats, but the leak of payment data remains a critical failure in protecting customer trust.

On May 18, 2018, Bombas, LLC suffered a data breach stemming from malware infiltrating its e-commerce platform. The incident exposed the personal and financial information of approximately 41,000 customers who conducted transactions between September 1, 2013, and February 9, 2015. Compromised data included names, addresses, and credit card details, all accessed without authorization. The breach was disclosed by the California Office of the Attorney General, highlighting vulnerabilities in the company’s payment processing system. While the exact duration of the malware’s presence remains undisclosed, the exposure period spanned over 17 months, raising concerns about prolonged undetected access. The breach did not involve ransomware demands or broader systemic disruptions but focused specifically on customer payment data, posing risks of fraud and identity theft. Bombas cooperated with authorities post-discovery, though the long-term repercussions for affected individuals—such as potential financial fraud or reputational harm to the brand—remain unresolved.