Bonobos Data Breach (2020): What Was Exposed & What To Do

In August 2020, a data breach at the clothing retailer Bonobos exposed records belonging to 2.8 million individuals. The incident involved nearly 70 GB of data that included email addresses, names, physical addresses, phone numbers, IP addresses, order histories, passwords stored as salted SHA-512 hashes, and partial credit card details. The exposure was reported on 14 August 2020 after the material was shared with the Have I Been Pwned service.

Breaking down the breach

The breach was identified through data provided to Have I Been Pwned by dehashed.com. Public reporting at the time stated that the dataset contained 2.8 million unique email addresses along with the additional categories of information listed above. No further details on the method of access, the precise date of the intrusion, or the duration of unauthorized access have been disclosed in available records.

How a breach like this happens

Incidents involving large volumes of customer records from retail systems commonly occur when an attacker obtains access to a database or backup storage. This can result from remote exploitation of server software, compromised administrative credentials, or misconfigured access controls that leave data repositories reachable from the internet. Once inside, an actor can copy entire tables or file directories, which explains the presence of both current and historical password hashes as well as partial payment information that many retailers retain for order processing.

Who is Bonobos?

Bonobos operates as an apparel retailer serving customers through an online store and physical locations. Like other companies in this sector, it collects and stores personal details required for order fulfillment, account management, and payment processing. A breach at such an organization is consequential because the data it holds directly links individuals to transactional histories and contact information that can be reused across other services.

What was likely exposed

The reported dataset included the following categories of information:

• Email addresses
• Names
• Physical addresses
• Phone numbers
• IP addresses
• Passwords stored as salted SHA-512 hashes, including historical passwords
• Partial credit card data consisting of card type, name on the card, expiry date, and the last four digits

Exact confirmation of every record contained in the 70 GB archive remains limited to these reported fields.

Why it matters

Exposure of email addresses and passwords, even when hashed, increases the chance that individuals will encounter credential-stuffing attempts on other websites where the same login details were reused. Partial credit card information combined with names and addresses can facilitate targeted fraud attempts, though the absence of full card numbers limits certain forms of immediate misuse. For the organization, the incident highlights the long-term retention of historical password data and the storage of payment details that together expand the potential impact on customers.

Were you affected?

Individuals can check whether their email address appears in known breach datasets by using a free exposure scan service. Practical next steps include changing passwords on the Bonobos account and any other sites that share the same credentials, enabling multi-factor authentication where available, and monitoring bank or credit card statements for unauthorized activity. Organizations that have not already done so should review password storage practices and limit retention of payment information to what is strictly necessary.

AICompiled with AI assistance from public sources and published under our editorial standards.