Romwe Data Breach

The verified classes are email addresses, names, phone numbers, IP addresses, physical addresses, locations and password hashes. This record indexes 19,531,820 unique email addresses, while a regulatory investigation reported stolen login credentials for more than seven million ROMWE accounts. These figures use different sources and grains; they must not be added or presented as 19.5 million confirmed customer accounts. Email and password hashes create takeover and credential-reuse risk, while names and phone numbers support personalized fraud. Address, location and IP data can make purchase or delivery messages more convincing. Payment card numbers are not a verified ROMWE class, so card findings from the broader investigation of the operator are not attributed to this record.

Zoetop Business Company, Ltd., ROMWE's operator, was targeted in a June 2018 cyberattack that reached its internal network. A company notice said ROMWE credentials may have been taken in July, while the regulatory investigation concluded that they likely left in the same 2018 attack. With no exact day disclosed, this record uses 1 June as a month-level reference. The company discovered ROMWE credentials online on 7 September 2020, reset affected passwords and notified users. Passwords in the examined dataset were described as salted SHA-1 hashes. Hashes are not plaintext, but SHA-1 is inadequate for password storage and weak choices may be recovered offline. The attack also involved another brand and payment systems operated by the company; evidence remains insufficient that card information appeared in this ROMWE dataset.

People who created a ROMWE account before mid-2018 and supplied a name, phone, email or delivery address form the main risk group. Risk is higher when the same password was reused on email, social media or another shop because attackers can test credentials elsewhere. Account data combined with address and phone details can support fake delivery notices, order problems, refunds, coupons, customs fees or verification messages. An abandoned account still matters: email and phone details may remain current for years, while an old address can aid social engineering. A dataset match does not prove that every listed field existed in that person's row, that the password was recovered, or that the account was abused. Exposure, password recovery and confirmed compromise are separate outcomes and should not be collapsed into one claim.

If you did not change your ROMWE password after the incident, or reused a similar one elsewhere, identify those accounts and assign each a strong, unique password. Prioritize email because reset links arrive there and mailbox access can lead to control of other services. Enable multi-factor authentication where supported, review recovery details and end unknown sessions. Check ROMWE order history, delivery addresses and saved methods; although card numbers are not verified in this dataset, report suspicious transactions to your bank. For shipping, return, discount or suspension messages, inspect the sender's real domain and link destination. Do not open unexpected attachments, sign in from a message link or disclose a one-time code. If you find an unauthorized change, secure the account and contact the service through its official support channel.

A password manager that creates a different password for every service limits the chance that a retail breach will spread. Enable breach and weak-password alerts, and prefer an authenticator app or hardware key for multi-factor authentication. Separate email aliases for shopping can reveal where an address was shared and make fraud easier to spot. Keep only information needed for delivery and transactions; remove obsolete addresses, phone numbers and connected apps. Consider deleting accounts you no longer use and confirm completion. Review bank activity and security alerts regularly, but do not rely on an email link; use the official app or an address you type directly. Older datasets can be combined with newer information, so this incident's age does not remove the need for continuing account hygiene and phishing awareness.

A matching email means the address appeared in the ROMWE-associated dataset of 19,531,820 unique addresses. It does not identify which of the more than seven million login records confirmed by the investigation it corresponds to, whether the account remains open, or whether plaintext is visible. If matched, ask whether the 2018 password was repeated elsewhere; secure email first and then accounts with the same or a similar old password. No match is an absolute safety guarantee: you may have registered with another address, opened the account later, or faced another unverified incident. Combine checks with password-manager alerts, multi-factor authentication and reviews of active sessions. For suspicious messages, assess the true sender domain, link destination, pressure to act and requests for payment or verification codes together. This turns a historical result into a continuing security practice.