P2021-ND-236

On November 20, 2020, the organization?s vendor was informed that the vendor?s service provider had a vulnerability on the server(s) that hosted one of the Organization?s websites, Bimba.com. As a result, an unauthorized user may have been able to access or acquire the personal information of the Organization?s customers. The unauthorized user inserted malicious code into web files causing unencrypted copies of e-commerce transaction data to be diverted to the unauthorized user. The information may have been exposed between August 21, 2020 and November 13, 2020.