ROMWE.com 2018 Data Breach: What Was Exposed and How It Happened

In June 2018, ROMWE.com, a popular Hong Kong-based online fashion retailer, suffered a data breach impacting over 20 million users worldwide. ROMWE’s platform is well known for offering trendy clothing and accessories to a global audience, but this incident revealed a significant vulnerability in its handling of customer data. During the breach, attackers accessed a range of sensitive information, including customer names, email addresses, phone numbers, physical addresses, IP addresses, geographic locations, and salted SHA-1 hashed passwords. The scale of the breach and the breadth of data exposed made headlines in the infosec community and raised immediate concerns for millions of online shoppers.

What Happened in the ROMWE.com Breach?

ROMWE.com discovered unauthorized access to its database in early June 2018. Investigation revealed that attackers exploited system vulnerabilities, granting access to confidential customer records. The exposed data set was significant not only in size but also in the scope of personal information it included. Over 20 million records were involved, making this one of the larger retail data breaches reported that year.
Compromised details included full names, phone numbers, email addresses, IP addresses, city/state/zip address information, and passwords stored as salted SHA-1 hashes provided some mitigation, but still warranted prompt response and increased scrutiny.

What Customer Data Was Exposed?

The breach exposed sensitive personal details, potentially affecting every customer who registered with ROMWE.com prior to June 2018. Specifically, leaked data fields consisted of:

Full names
Email addresses
Phone numbers
IP addresses
Geographical locations and mailing addresses
Hashed and salted passwords (using SHA-1)

This combination of information could enable various forms of phishing or social engineering if misused by malicious actors.

How Many ROMWE.com Users Were Impacted?

The breach affected 20,322,959 customer records. The majority of those impacted had placed orders or created accounts on ROMWE prior to June 2018. This number puts the ROMWE incident among the more substantial retail breaches in recent history.

Breach Timeline

June 1, 2018: The breach took place, with attackers gaining access to the data.
Mid-2018: The breach’s extent became public as security researchers analyzed and reported the leaked data.

The quick discovery and reporting of the breach helped limit further risk, but the exposed information was already outside of ROMWE’s control by the time it was identified.

FAQ About the ROMWE.com 2018 Data Breach

What was the ROMWE.com data breach?

The ROMWE.com data breach was a security incident in June 2018 where unauthorized parties accessed and exfiltrated data related to over 20 million customers, including personal and account-related information.

How many users were affected in the ROMWE breach?

The breach involved 20,322,959 customer records, covering a wide range of individuals who shopped or registered on ROMWE.com before June 2018.

What information was leaked in the ROMWE.com data breach?

Leaked data included full names, email addresses, phone numbers, mailing addresses, geographic locations, IP addresses, and salted SHA-1 hashed passwords.

When did the ROMWE data breach happen?

The breach occurred in early June 2018 and details became public shortly afterward during the summer of 2018.

How can I check if I'm in the ROMWE.com breach?

You can check if your information was part of the ROMWE.com breach by utilizing the DeHashed search engine.