Romwe Data Breach (2018): What Was Exposed & What To Do

In June 2018, reports surfaced that the online retailer Romwe had suffered a data breach affecting 19.5 million customers. The incident, which took place in mid-2018, resulted in customer records appearing for sale on underground forums, with the dataset later supplied to Have I Been Pwned by dehashed.com. The breach exposed names, phone numbers, email addresses, IP addresses, geographic locations, physical addresses, and passwords stored as salted SHA-1 hashes.

Breaking down the breach

Public records indicate the breach was first noted around 1 June 2018. The compromised dataset contained records for 19.5 million individuals. No official statement from the company detailing the intrusion method, exact date of compromise, or duration of unauthorized access has been referenced in available reporting. The data subsequently circulated on online marketplaces before being shared with breach-tracking services.

How a breach like this happens

Incidents involving retail customer databases often stem from unauthorized access to web servers or backend systems that store account information. Attackers may exploit unpatched software, weak authentication controls, or stolen credentials to reach these repositories. Once inside, they can copy large volumes of records without immediate detection. The subsequent sale of the data on forums is a common pattern, allowing the material to reach multiple buyers over time.

Who is Romwe?

Romwe is a Hong Kong-based online fashion retailer that sells clothing and accessories directly to consumers through its website. Like similar e-commerce platforms, it collects and retains customer details necessary for order processing, shipping, and account management. A breach at such a company is consequential because the stored information typically includes identifiers and contact data that remain valid for years after the original transaction.

What data was at risk

The records reported as exposed include the following elements:

• Names
• Phone numbers
• Email addresses
• IP addresses
• Geographic locations
• Physical addresses
• Passwords stored as salted SHA-1 hashes

Exact confirmation of every field present in the full dataset remains limited to the descriptions provided by sources that obtained the material.

The real-world impact

Individuals whose information appeared in the dataset face the possibility of targeted phishing messages, unsolicited marketing, or attempts to access other accounts if the same passwords were reused elsewhere. Hashed passwords require additional effort to reverse, yet older hashing methods can be processed offline once the data is obtained. For the organization, the incident created reputational and operational consequences typical of large-scale retail exposures, including potential regulatory scrutiny and customer support demands.

What to do if you're exposed

Anyone who used Romwe should change the password associated with that account and any other service where the same credentials were reused. Enable multi-factor authentication on important accounts and monitor bank and email statements for unusual activity. Individuals can also run a free exposure scan of their email address against known breach datasets to determine whether their information has appeared in this or other incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.