Romwe romwe.com Romwe data breach: what happened and what to do
Romwe, a Hong Kong-based online fashion retailer, had a breach in mid-2018 that exposed almost 20 million customers (19,531,820 accounts in Have I Been Pwned). Names, phone numbers, email and IP addresses, locations and passwords stored as salted SHA-1 hashes were exposed.
View all 13,115 breaches- Breach date
- Jun 2018
- Affected
- 19,531,820
- Data exposed
- Geographic locations, IP addresses, Names, Passwords, Phone numbers, Physical addresses
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
Romwe is a Hong Kong-based online fashion retailer. Have I Been Pwned lists a breach from mid-2018 that exposed 19,531,820 accounts. The data was later sold online.
What happened
The breach dates to June 2018, according to Have I Been Pwned, and the data was added to its database in January 2021. A New York Attorney General settlement with Romwe's parent company, Zoetop, which also runs Shein, says the company didn't realize the attack had happened until its payment processor told it. Zoetop agreed to pay New York $1.9 million over how it handled the breach.
What was exposed
Names, phone numbers, email addresses, IP addresses, customers' geographic locations and passwords stored as salted SHA-1 hashes. SHA-1 is an old, fast hashing method, so weak passwords can be cracked from the hashes.
What that means for you
Email, phone and location together make targeted scam texts and emails easy to write: a fake delivery notice or a fake refund from a fashion retailer is believable. Anyone who cracked your password and tried it elsewhere could get into other accounts if you reused it. Romwe says accounts created after July 14, 2018 were not affected.
What to do if you were in it
- 1
Change your Romwe password and anywhere you reused it
The passwords were stored as salted SHA-1 hashes, which attackers can crack, especially weak ones. Pick a new, unique password for Romwe and for any other account that shared it. A password manager makes that painless.
- 2
Turn on two-factor authentication
Use an authenticator app or a passkey on your email, banking and shopping accounts. A leaked password then isn't enough to log in.
- 3
Expect phishing that mentions Romwe
Names, emails and phone numbers let scammers write believable messages. Treat unexpected emails and texts that mention Romwe or your orders with suspicion, and go to the site directly instead of clicking links.
- 4
Check your card statements
Look for charges you don't recognize on any card you used at Romwe around 2018, and ask your bank to replace the card if something looks off.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your data appears, so you hear about the next one early. It can't remove data from a breach, so the alert is the useful part.
Frequently asked
Was I affected by the Romwe breach?
Have I Been Pwned lets you check an email address against this breach. Accounts created after July 14, 2018 were not affected, per Romwe.
What was exposed?
Names, phone numbers, email addresses, IP addresses, geographic locations and passwords stored as salted SHA-1 hashes.
Should I change my password?
Yes, if you used the same password on Romwe and anywhere else. Change both and use a unique password for each site.
Was Romwe fined?
Its parent company Zoetop agreed to pay New York $1.9 million in 2022 over the breach, per the New York Attorney General's settlement as reported by Dark Reading.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
