SHEIN shein.com SHEIN data breach: what happened and what to do
In June 2018, online fashion retailer SHEIN was breached. The company found it in August and disclosed it in September. Have I Been Pwned counts about 39 million email addresses with MD5 password hashes. SHEIN's own announcement put the figure at 6.42 million customers.
View all 13,115 breaches- Breach date
- Jun 2018
- Affected
- 39,086,762
- Data exposed
- Email addresses, Passwords
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
SHEIN's systems were breached in June 2018. The company discovered the breach about two months later, in August, and disclosed it a month after that. At the time, SHEIN said it had brought in a forensic cybersecurity firm and a law firm, removed the malware and closed the entry points the attackers had used.
How many people
The numbers differ by source. SHEIN's own announcement said 6.42 million customers who had registered on its website were affected. Have I Been Pwned, which added the data in July 2019, counts 39,086,762 unique email addresses in the dataset. Use the larger figure as the safer assumption: if your email address was ever on a SHEIN account, check it.
What was exposed
The data was email addresses and passwords. The passwords were stored as MD5 hashes, an old and fast method that attackers can crack in bulk, especially for simple passwords. SHEIN said it found no evidence that payment data was taken and that it doesn't store full card details on its systems.
What it means for you
A short, common password can be recovered from an MD5 hash in minutes. If you used your SHEIN password anywhere else, attackers can try it on those accounts too. An email address on its own is enough to receive phishing, and shopping brands are a favorite disguise: fake order, delivery or refund messages are easy to write for a store people actually use.
Change the password if you have a SHEIN account from before late 2018 and haven't updated it since.
What to do if you were in it
- 1
Change the password and anywhere you reused it
Set a new password on the affected account. Then change it on any other site where you used the same one, starting with email and banking. A password manager makes unique passwords painless.
- 2
Turn on two-factor login
Use an authenticator app or a security key on your email, bank and shopping accounts. A stolen password alone then isn't enough to get in.
- 3
Expect phishing that mentions the breach
Criminals use your email address and the fact that you shop at SHEIN to write messages that look personal. Don't click links in unexpected emails or texts about your account. Go to the site directly instead.
- 4
Check whether your email or phone is in this and other breaches
Run a free scan with Serus to see which breaches include your email address or phone number. Serus monitors breach databases and the dark web and alerts you if your data shows up again.
Frequently asked
Was I affected by the SHEIN data breach?
If you had a SHEIN account in 2018, possibly. Search your email address on Have I Been Pwned to see whether it appears.
What was exposed?
Email addresses and passwords stored as MD5 hashes. SHEIN said it found no evidence that payment data was taken.
Why do the numbers differ?
SHEIN announced 6.42 million affected customers. Have I Been Pwned lists about 39 million unique email addresses in the dataset it received.
Should I change my password?
Yes, if you still use a password from 2018 or reused it elsewhere. Use a unique password for each account.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
