Bonobos bonobos.com Bonobos data breach: what happened and what to do
Bonobos, the men's clothing retailer, had a breach in August 2020 that exposed 2,811,929 accounts in Have I Been Pwned. Names, addresses, phone numbers, order history, partial card data and password hashes, including historical passwords, were exposed.
View all 13,115 breaches- Breach date
- 14 Aug 2020
- Affected
- 2,811,929
- Data exposed
- Email addresses, Historical passwords, IP addresses, Names, Partial credit card data, Passwords, Phone numbers, Physical addresses, Purchases
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
Bonobos is a men's clothing retailer. In August 2020 a backup of its customer database, almost 70GB, was taken. Have I Been Pwned lists 2,811,929 accounts.
What happened
The data was leaked publicly in January 2021. Bonobos said it found no evidence that attackers reached its internal systems. An unauthorized party had viewed a backup file in an external cloud environment, and the company said payment information was not affected. Bonobos forced password resets and began notifying customers in late January 2021.
What was exposed
Email addresses, names, physical and IP addresses, phone numbers, order histories, passwords stored as salted SHA-512 hashes (including historical passwords), and partial credit card data: card type, name on the card, expiry date and last 4 digits.
What that means for you
Name, address, phone number and order history is what a scammer needs for a believable "problem with your order" message. The partial card data isn't enough to charge a card, but it does make a fake bank or retailer call more convincing. Historical passwords matter too: if you reused an old Bonobos password, it could still work somewhere else.
What to do if you were in it
- 1
Change your Bonobos password and anywhere you reused it
The passwords were stored as salted SHA-512 hashes, which attackers can crack, especially weak ones. Pick a new, unique password for Bonobos and for any other account that shared it. A password manager makes that painless.
- 2
Turn on two-factor authentication
Use an authenticator app or a passkey on your email, banking and shopping accounts. A leaked password then isn't enough to log in.
- 3
Expect phishing that mentions Bonobos
Names, emails and phone numbers let scammers write believable messages. Treat unexpected emails and texts that mention Bonobos or your orders with suspicion, and go to the site directly instead of clicking links.
- 4
Review your card statements
Only the last 4 digits and expiry date were exposed, but watch for charges you don't recognize and be wary of calls that quote your card details.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your data appears, so you hear about the next one early. It can't remove data from a breach, so the alert is the useful part.
Frequently asked
Was I affected by the Bonobos breach?
Check your email on Have I Been Pwned, which lists 2,811,929 accounts. Bonobos also notified affected customers.
Were my full card details exposed?
No. The partial card data was the card type, name, expiry date and last 4 digits. Bonobos said payment information was not affected.
What else was exposed?
Names, addresses, phone numbers, IP addresses, order history and password hashes, including historical passwords.
Should I change my password?
Yes, and change it anywhere you used the same one.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
