Bonobos Data Breach

What happened?

In August 2020, the clothing store Bonobos suffered a data breach that exposed almost 70GB of data containing 2.8 million unique email addresses. The breach also exposed names, physical and IP addresses, phone numbers, order histories and passwords stored as salted SHA-512 hashes, including historical passwords. The breach also exposed partial credit card data including card type, the name on the card, expiry date and the last 4 digits of the card. The data was provided to HIBP by dehashed.com .

When did it happen?

The breach date in the public record is August 14, 2020. The record was added to the catalogue on January 31, 2021 and last updated there on January 31, 2021.

What information was reported as exposed?

• Email addresses
• Historical passwords
• IP addresses
• Names
• Partial credit card data
• Passwords
• Phone numbers
• Physical addresses
• Purchases

These are incident-level categories. The record does not prove that every category was exposed for every affected person.

Who may be affected?

This record may be relevant to people who had an account or other relationship with Bonobos or used bonobos.com around August 14, 2020. A catalogue entry does not establish that every customer was affected or that every listed data category applied to each person. Compare the record with an official notice addressed to you.

What should you do?

Choose actions that match the information involved. If you find signs that someone is using your identity, the Federal Trade Commission provides a personal recovery plan at IdentityTheft.gov.