Breach Disclosure: SHEIN

Breach Disclosure: Shein

Canadian online retailer SHEIN was affected by a data breach in June 2018, due to backdoored company servers. This resulted in the exposure of 39 million unique email addresses, as well as MD5 hashed passwords. No customer payment information was involved in this breach.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• Remain alert to potential spear phishing attacks through email and social media.

Details

In June 2018, online fashion retailer SHEIN disclosed a data breach affecting 6.42 million customers. Exposed data consisted of user email addresses, and MD5 hashed passwords. Details in the press statement announcing the breach indicate that malware on company servers ultimately led to data exposure. As SHEIN does not store credit card information on its servers, no financial information was leaked. In the wake of the breach, SHEIN offered affected customers one year of identity monitoring services.