Bonobos Breach Exposes 2.8 M Customer Records Including Partial Credit‑Card Data
What Happened — In August 2020 the online retailer Bonobos suffered a data breach that released roughly 70 GB of information. The leak contained 2,811,929 unique email addresses plus names, physical and IP addresses, phone numbers, order histories, salted SHA‑512 password hashes (including historical passwords), and partial credit‑card data (card type, name, expiry, last 4 digits).
Why It Matters for Trust & Control Assurance
- Continuous credential‑management monitoring is required to detect and evidence weak password storage before a breach occurs.
- Documented hashing standards, MFA enforcement, and audit‑ready logs provide defensible proof of control effectiveness during investigations.
- A control‑assurance program that captures evidence of data‑handling policies helps demonstrate due‑diligence to regulators and partners.
Who Is Affected – Retail and e‑commerce organizations that store customer PII and payment information; roughly 2.8 M Bonobos shoppers.
Recommended Actions – Review and upgrade password‑hashing algorithms; enforce multi‑factor authentication for privileged accounts; capture and retain evidence of these controls in a continuous monitoring platform. Source: Have I Been Pwned – Bonobos breach
Technical Notes – Exfiltrated data included email addresses, names, physical and IP addresses, phone numbers, purchase histories, salted SHA‑512 password hashes (historical), and partial credit‑card details (type, name, expiry, last 4 digits). Source: same as above