Fashion Nexus fashionnexus.co.uk Fashion Nexus data breach: what happened and what to do
UK ecommerce company Fashion Nexus suffered a breach in July 2018. Have I Been Pwned lists 1,279,263 accounts, with names, email addresses, phone numbers, physical addresses, dates of birth and passwords.
View all 13,115 breaches- Breach date
- 9 Jul 2018
- Affected
- 1,279,263
- Data exposed
- Browser user agent details, Dates of birth, Email addresses, Genders, IP addresses, Names, Passwords, Phone numbers, Physical addresses, Purchases
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
Fashion Nexus is a UK ecommerce company. In July 2018 it suffered a data breach that affected multiple websites built by its sister company White Room Solutions, including Jaded London and AX Paris.
Have I Been Pwned lists 1,279,263 accounts. Counts in press reports differ: coverage cited figures from about 922,000 unique email addresses (the company's own estimate) up to 1.4 million records. This page uses HIBP's number.
What was exposed
HIBP lists browser user agent details, dates of birth, email addresses, genders, IP addresses, names, passwords, phone numbers, physical addresses and purchases. Passwords were stored as a mix of salted MD5, salted SHA-1 and unsalted MD5, so many of them are easy to crack. Press reports said financial information was not involved.
What happened next
The database was found by an ethical hacker, according to Graham Cluley's report. Jaded London said the data came from a historic database held on a server run by Fashion Nexus and that its live site was not compromised. Fashion Nexus said it informed the UK data protection regulator, the ICO. When asked by reporters for a public statement, the company's reply was a one-word "No".
What it means for you
A name, home address, phone number and birth date together are the raw material for identity theft and very believable delivery or refund scams. Because the data includes what you bought, a scammer can reference a real order.
If you shopped on these sites around 2018 and reused that password, change it everywhere it appears.
What to do if you were in it
- 1
Change your password, and anywhere you reused it
Set a new, unique password on any site using the same password. If you used the same password on other accounts, change those too. A password manager makes unique passwords painless.
- 2
Turn on two-factor authentication
Add 2FA to your email, banking and shopping accounts first. If an old password is still in circulation, a second step stops most takeover attempts.
- 3
Expect phishing that mentions the breach
Emails or texts that cite this breach, or claim your account is locked, are a common follow-up. Don't click the link. Open the site yourself instead.
- 4
Watch your accounts for new activity
Because names, addresses and birth dates were exposed, keep an eye on bank statements and credit reports for anything you don't recognize.
- 5
Check whether your email is in this and other breaches
Run a free Serus scan. It checks your email and phone number against breach databases and the dark web, and Serus alerts you if they show up in a new one.
Frequently asked
Was I affected by the Fashion Nexus breach?
Have I Been Pwned lists 1,279,263 accounts. Search your email on its site, or run a free Serus scan.
What was exposed in the Fashion Nexus breach?
HIBP lists names, email addresses, phone numbers, physical addresses, dates of birth, purchases, IP addresses and hashed passwords.
Why do the numbers differ between reports?
Press reports cited figures from 922,000 email addresses to 1.4 million records. This page uses HIBP's count.
Should I change my password?
Yes, if you had an account on one of the affected sites and used that password elsewhere.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
