Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
The SHEIN breach happened in June 2018—not recently. In October 2022, New York’s Attorney General said the incident exposed credentials for 39 million SHEIN accounts, far more than the 6.42 million consumers Zoetop had publicly claimed were affected. If you reused your SHEIN password elsewhere, change it on those other accounts and use a different password for each service.
What happened in the SHEIN breach?
According to the New York State Office of the Attorney General (OAG), attackers targeted Zoetop, then the operator of SHEIN and ROMWE, in June 2018. The OAG’s investigation found that attackers gained access to the company’s internal network, accessed SHEIN customer information, and altered transaction-processing code in an attempt to intercept and remove payment-card information. The findings are described in the OAG’s October 12, 2022 announcement and its executed assurance.
The exposed SHEIN information included customer names, email addresses, and hashed account passwords. The OAG said the password hashing method used at the time was insufficient. A forensic firm could not determine whether attackers successfully exfiltrated credit-card information, so the official findings do not establish that card details were stolen.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteHow many SHEIN and ROMWE accounts were affected?
The OAG’s 2022 findings distinguish the number of affected accounts from Zoetop’s public account of the incident:
#1 Best Overall
| Figure | What it refers to | Attribution |
|---|---|---|
| 39 million | SHEIN account credentials stolen in the incident | New York State OAG, 2022 |
| 7 million | ROMWE accounts involved in the incident | New York State OAG, 2022 |
| 6.42 million | The number Zoetop falsely said were affected | New York State OAG, 2022 |
| More than 32.5 million | SHEIN users the OAG said Zoetop did not notify that their credentials had been stolen | New York State OAG, 2022 |
These are aggregate historical findings, not a way to determine whether a particular person’s account was affected or whether that person received a notice. The assurance names SHEIN Distribution Corporation and Zoetop Business Company, Limited as parties; it should not be read as evidence that Zoetop is SHEIN’s current operating entity.
What does the breach mean for your account?
The OAG’s findings do not establish the current status of any individual SHEIN account. They also do not show whether a particular user was notified. But if you used the same password on SHEIN and another service, the stolen credentials could put that other account at risk: attackers commonly try username-and-password combinations from one breach on other services. The OAG explains this practice, known as credential stuffing, in its data-breach guidance.
What should you do if you reused your password?
- Change the reused password everywhere else you used it. Go directly to each service’s official website or app, sign in, and set a different password. Do not reuse the old password or the replacement across accounts.
- Use a unique password for each account. A password manager can optionally generate and store distinct passwords; choose one based on its security features, supported devices, recovery process, and price.
- Follow any account-security instructions you receive. The OAG says businesses responding to a data incident should secure affected accounts, including by resetting passwords or telling customers their accounts are at risk. A notice—or lack of one—does not establish an individual account’s current status.
What did New York require after the investigation?
In October 2022, the OAG announced that New York secured $1.9 million in penalties and costs from Zoetop and said the settlement required stronger security and incident-response measures. Attorney General Letitia James said: “SHEIN and ROMWE’s weak digital security measures made it easy for hackers to shoplift consumers’ personal data.” The statement and settlement details appear in the OAG announcement.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
