Breach Disclosure: Romwe

On December 30 2020, Hong Kong-based retailer Romwe disclosed a data breach to its customers. According to the company, they discovered the breach in September 2020 which occurred sometime in July 2018. The data was being sold and mentioned being sold on RaidForums in December 2020. The breach contains approximately 20 million rows of names, phone numbers, email addresses, IP addresses, geographic locations and salted SHA-1 password hashes.

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

On December 31 2020, Yahoo posted an article detailing the breach. According to Romwe, no credit or debit card information was stolen.

Although the disclosure came out in December 2020, RaidForums, a cybercriminal forum that has vendors who buy, sell and trade data breaches, had a number of posts in November advertising the sale of the database.

imgur

Figure 1: RaidForums Post

According to chatter on RaidForums, Romwe generated passwords for their users during account sign-up, and many users did not change their passwords after account creation. This has not been validated by ZeroFOX Alpha Team.