Online Retailer Settles New York State Investigation Over Consumer Data Breach

An online retailer agreed to pay $65,000 in penalties and implement certain remedial data security policies in order to resolve a consumer data breach investigation conducted by the New York Attorney General.

According to Attorney General Letitia James, in September 2014, hackers used malicious software code inserted into the e-commerce platform supporting the website of retailer Bombas LLC ("Bombas") to steal stored credit and debit card information from 39,561 customers. Bombas allegedly discovered the code after two months, but neglected to remove it permanently for another two months. Bombas then failed to notify the 2,971 affected New York resident consumers until May 2018 - more than three years after the breach - in violation of New York General Business Law 899-aa, which requires breach victims to make disclosures to applicable state regulators and affected customers "in the most expedient time possible and without unreasonable delay."