Shein

Disclosed Sep 21, 201839,000,000 affectedSettled

2018 breach of 39M Shein accounts mishandled; USD 1.9M New York AG penalty

A 2018 breach at Zoetop exposed 39 million SHEIN and 7 million ROMWE accounts. New York's attorney general found Zoetop failed to protect many affected accounts and downplayed the breach, and fined it USD 1.9M.

What is known

People affected	39,000,000 (as reported by the organization)
Disclosed	Sep 21, 2018
Discovered	Aug 8, 2018
Happened	Jun 1, 2018
Attack	Hacking
Data exposed	EmailsPasswordsNamesAddresses
Sector	Retail · US
Status	Settled
Lawsuit or fine	USD 1.9M New York AG penalty (Oct 2022) (about $1.9M)
Check your email	Have I Been Pwned

Sources

Official noticeoag.ca.gov

California Attorney General breach notice: Shein

Official noticejustice.oregon.gov

Oregon DOJ breach notice: Shein

Aggregatorhaveibeenpwned.com

Have I Been Pwned: SHEIN

Regulatorag.ny.gov

NY AG: USD 1.9 Million from SHEIN and ROMWE owner Zoetop

Newstechcrunch.com

Shein owner fined $1.9M for failing to notify 39M users of data breach

Official noticein.gov

Indiana Attorney General 2018 data breach report: SHEIN

Official noticemaine.gov

Maine Attorney General breach notice archive: Shein

Notices filed

Residents of INSep 21, 2018

Indiana AG10,000 people

Residents of CAOct 10, 2018

California AGCount not stated

Residents of OROct 11, 2018

Oregon DOJ6,420,000 people

Residents of MEOct 17, 2018

Maine AGCount not stated

Accounts in the dataJul 17, 2019

Have I Been Pwned39,086,762 people

TotalJul 17, 2019

Research39,000,000 people

History of this record

data_types2026-09-25

["emails","passwords","names"] to ["emails","passwords","names","addresses"]by backfillSource

disclosed2026-09-25

2018-10-10 to 2018-09-21by backfillSource

status2026-09-25

confirmed to settledby seedSource

fine_usd2026-09-25

empty to 1900000by seedSource

lawsuit2026-09-25

empty to USD 1.9M New York AG penalty (Oct 2022)by seedSource

sector2026-09-25

tech to retailby seedSource

attack2026-09-25

unknown to hackingby seedSource

data_types2026-09-25

["emails","passwords"] to ["emails","passwords","names"]by seedSource

records_basis2026-09-25

hibp to organizationby seedSource

records2026-09-25

39086762 to 39000000by seedSource

summary2026-09-25

In June 2018, online fashion retailer SHEIN suffered a data breach . The company discovered the breach 2 months later in August then disclosed the incident another month after that. A total of 39 million unique email addresses were found in to A 2018 breach at Zoetop exposed 39 million SHEIN and 7 million ROMWE accounts. New York's attorney general found Zoetop failed to protect many affected accounts and downplayed the breach, and fined it USD 1.9M.by seedSource

title2026-09-25

empty to 2018 breach of 39M Shein accounts mishandled; USD 1.9M New York AG penaltyby seedSource

hibp2026-09-25

empty to SHEINby backfillSource

sector2026-09-25

other to techby backfillSource

data_types2026-09-25

[] to ["emails","passwords"]by backfillSource

records_basis2026-09-25

empty to hibpby backfillSource

records2026-09-25

empty to 39086762by backfillSource

summary2026-09-25

empty to In June 2018, online fashion retailer SHEIN suffered a data breach . The company discovered the breach 2 months later in August then disclosed the incident another month after that. A total of 39 million unique email addresses were found inby backfillSource

discovered2026-09-25

empty to 2018-08-08by backfillSource

Added2026-09-25

First recordedby backfillSource

First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.

Everything about Shein