Bonobos clothing store suffers a data breach, hacker leaks 70GB database


Level 85
Thread author
Top poster
Content Creator
Malware Hunter
Aug 17, 2014
Bonobos men's clothing store has suffered a massive data breach exposing millions of customers' personal information after a cloud backup of their database was downloaded by a threat actor. Bonobos states that the corporate systems were not breached during the attack.
Bonobos started as an online men's clothing store but later expanded to sixty locations to try on clothes before purchasing them. Walmart bought Bonobos in 2017 for $300 million to sells its clothing on their site. [...]
After BleepingComputer contacted Bonobos about the leaked database, the clothing store told us that the threat actors did not gain access to internal systems but rather to a backup file hosted in an external cloud environment.
"Protecting our customers’ data is something we take very seriously. We’re investigating this matter further and, so far, have found no evidence of unauthorized parties gaining access to Bonobos’ internal system. What we have discovered is an unauthorized third party was able to view a backup file hosted in an external cloud environment. We contacted the host provider to resolve this issue as soon as we became aware of it." "Also, we have taken additional precautionary steps, including turning off access points, invalidating account passwords and requiring password resets, to further secure customer accounts. We're emailing customers to notify them that their contact information and encrypted passwords may have been viewed by an unauthorized third party. Payment information was not affected by this issue. We’ll continue to share updates with customers as they become available," Bonobos told BleepingComputer via email.


Level 15
Top poster
Content Creator
Sep 1, 2017
Wowzers! Well ... sadly, this is getting all too common nowadays... Thoughts are with all of those involved - quite the breach! Never used this company before, but I would say stay away for a while and then go back as they probably will have even better security after that (or one would seriously hope)! However, (general knowledge here) most companies see revenues drop like a rocket after a breach and lose a lot of new customers or existing customers too. The sad situation here...


Level 3
Jul 25, 2020
Major breaches happen every single day, 24/7/365. The breaches that you read about in the IT security news are only a tiny number of the millions of breaches that never get reported every year.

The greatest threat to your valuable personal data is not your local host becoming infected. It is 3rd party systems being breached. That has always been the case but IT security hysteria corrals and herds people into thinking that their number 1 security risk is their personally owned devices and systems.

I can guarantee that if your cell phone is spammed with robo and other unsolicited calls, then a database out there with your infos in it has either been abused or breached.