Bonobos men’s clothing store has suffered a massive data breach exposing millions of customers’ personal information after a cloud backup of their database was downloaded by a threat actor. Bonobos states that the corporate systems were not breached during the attack.
Bonobos started as an online men’s clothing store but later expanded to sixty locations to try on clothes before purchasing them. Walmart bought Bonobos in 2017 for $300 million to sells its clothing on their Jet.com site.
This leaked database is a monstrous 70 GB SQL file containing various internal tables used by the Bonobos website. The database also includes various data far more interesting to threat actors, such as customers’ addresses, phone numbers, partial credit card numbers (last four digits), order information, password histories.
The amount of records varies depending on the category of the data. For example, the address and phone numbers are for 7 million customers/orders, account information for 1.8 million registered customers, and 3.5 million partial credit card records.
|
Bonobos sent an email communication to their customers prompting them to change passwords for their Bonobos account and any other accounts that share the same password. |
The company later sent HMG-CN a statement:
To clarify, 7 million customers were not impacted. Rather, a total of 7 million addresses were visible. Customers often ship to more than one address, or use a different billing address, but again, this does not mean 7 million customers were impacted. In fact, the number was far less.
We suggest updating the above to the following:
