Historical Cyber Incident and Sensitive Data Breach (SSNs) (high) On February 5, 2019, BambooHR experienced a cyber incident where an unauthorized third party accessed sensitive employee data, including names, Social Security Numbers (SSNs), states of residence/employment, wage types, and tax codes. The attackers attempted to redirect payroll deposits to their own accounts, indicating financial motivation.. Unexplained $1.75 Billion Deal and Ownership Change (high) A news report dated October 3, 2025, indicates that White Mountains announced a $1.75 billion deal involving CVC and BambooHR, with White Mountains retaining a 15% equity stake. This recent, massive transaction suggests a critical, unanalyzed change in the company's ownership structure, valuation, and capital stack, requiring immediate investigation into the terms of the CVC/White Mountains transaction.. Extreme Discrepancy in Reported Annual Revenue (medium) Tracxn reports BambooHR's Annual Revenue as only €250K (approximately $263K USD) as of December 31, 2022. This figure is highly improbable for a late-stage, Private Equity-backed company founded in 2008 with an employee count ranging from 661 (2022 Tracxn) to 1,734 (2025 PitchBook), and which was recently valued in a $1.75 billion deal. This signals severe unreliability or incompleteness in key third-party financial data.