Shein
Disclosed Sep 21, 20188 years ago39,000,000 affectedSettled
2018 breach of 39M Shein accounts mishandled; USD 1.9M New York AG penalty
A 2018 breach at Zoetop exposed 39 million SHEIN and 7 million ROMWE accounts. New York's attorney general found Zoetop failed to protect many affected accounts and downplayed the breach, and fined it USD 1.9M.
What is known
| People affected | 39,000,000 (as reported by the organization) |
|---|---|
| Disclosed | Sep 21, 2018 |
| Discovered | Aug 8, 2018 |
| Happened | Jun 1, 2018 |
| Attack | Hacking |
| Data exposed | Emails, Passwords, Names, Addresses |
| Sector | Retail · US |
| Status | Settled |
| Lawsuit or fine | USD 1.9M New York AG penalty (Oct 2022) (about $1.9M) |
| Check your email | Have I Been Pwned |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: Sheinoag.ca.gov · Official notice | Official notice |
| Oregon DOJ breach notice: Sheinjustice.oregon.gov · Official notice | Official notice |
| Have I Been Pwned: SHEINhaveibeenpwned.com · Aggregator | Aggregator |
| NY AG: USD 1.9 Million from SHEIN and ROMWE owner Zoetopag.ny.gov · Regulator | Regulator |
| Shein owner fined $1.9M for failing to notify 39M users of data breachtechcrunch.com · News | News |
| Indiana Attorney General 2018 data breach report: SHEINin.gov · Official notice | Official notice |
| Maine Attorney General breach notice archive: Sheinmaine.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| Indiana AGresidents of IN | Sep 21, 2018 | 10,000 |
| California AGresidents of CA | Oct 10, 2018 | |
| Oregon DOJresidents of OR | Oct 11, 2018 | 6,420,000 |
| Maine AGresidents of ME | Oct 17, 2018 | |
| Have I Been Pwnedaccounts in the data | Jul 17, 2019 | 39,086,762 |
| Researchtotal | Jul 17, 2019 | 39,000,000 |
History of this record
- 2026-09-25 · data_types: ["emails","passwords","names"] to ["emails","passwords","names","addresses"] · backfill source
- 2026-09-25 · disclosed: 2018-10-10 to 2018-09-21 · backfill source
- 2026-09-25 · status: confirmed to settled · seed source
- 2026-09-25 · fine_usd: empty to 1900000 · seed source
- 2026-09-25 · lawsuit: empty to USD 1.9M New York AG penalty (Oct 2022) · seed source
- 2026-09-25 · sector: tech to retail · seed source
- 2026-09-25 · attack: unknown to hacking · seed source
- 2026-09-25 · data_types: ["emails","passwords"] to ["emails","passwords","names"] · seed source
- 2026-09-25 · records_basis: hibp to organization · seed source
- 2026-09-25 · records: 39086762 to 39000000 · seed source
- 2026-09-25 · summary: In June 2018, online fashion retailer SHEIN suffered a data breach . The company discovered the breach 2 months later in August then disclosed the incident another month after that. A total of 39 million unique email addresses were found in to A 2018 breach at Zoetop exposed 39 million SHEIN and 7 million ROMWE accounts. New York's attorney general found Zoetop failed to protect many affected accounts and downplayed the breach, and fined it USD 1.9M. · seed source
- 2026-09-25 · title: empty to 2018 breach of 39M Shein accounts mishandled; USD 1.9M New York AG penalty · seed source
- 2026-09-25 · hibp: empty to SHEIN · backfill source
- 2026-09-25 · sector: other to tech · backfill source
- 2026-09-25 · data_types: [] to ["emails","passwords"] · backfill source
- 2026-09-25 · records_basis: empty to hibp · backfill source
- 2026-09-25 · records: empty to 39086762 · backfill source
- 2026-09-25 · summary: empty to In June 2018, online fashion retailer SHEIN suffered a data breach . The company discovered the breach 2 months later in August then disclosed the incident another month after that. A total of 39 million unique email addresses were found in · backfill source
- 2026-09-25 · discovered: empty to 2018-08-08 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.