Breach Disclosure: Bonobos

Bonobos, the popular men's clothing store, suffered a data breach in January 2021 exposing the records of over 7 million customers. The data includes shipping addresses, phone numbers, partial credit card numbers, order information and password history (hashed with SHA-256). This breach has been attributed to ShinyHunters, which continues to release breached data and databases for free after they appear for sale in hacker forums.

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

The hacker under the alias of ShinyHunters posted the breached Bonobos database data for free on a popular hacking forum, providing download links for a 70GB SQL file containing a dump of data from the breached database. This SQL file can be used to recreate internal databases used by Bonobos website, including customer information which could be used for fraudulent purposes or targeted phishing attacks.

Figure 1: Post from ShinyHunters advertising Bonobos breach data

The breached data contains 7 million shipping addresses, 1.8 million records of account information and 3.5 million partial credit card numbers. Passwords are also contained in the data and are salted and hashed using SHA-256. Other users of the hacker forum are also posting cracked email and password combinations for sale from the data breach.

Figure 2: Other users advertising cracked passwords for sale