New York Attorney General Letitia James announced a $1.9 million penalty for Zoetop, the company that owns Shein and Romwe. Millions of user accounts on the shopping sites were stolen.The company behind ultra fast fashion brands Shein and Romwe will pay New York state $1.9 million over a data breach affecting millions of customers. The fine stems fromthat Zoetop failed to secure customers’ data, didn’t properly inform customers of a data breach, and tried to keep the extent of the leak quiet.
The penalty comes after an investigation by the Office of the Attorney General into a 2018 hack in which credit card and personal information, like names, emails, and hashed passwords, was stolen. The data breach affected 39 million Shein and 7 million Romwe accounts, including more than 800,000 accounts belonging to New Yorkers.According to the OAG, after Zoetop learned of the hack, the company only contacted some of the affected customers and failed to reset passwords for any of the accounts.
Two years later, Romwe customers were notified of a data breach after Zoetop found customer logins on the dark web believed to be from the 2018 hack. When Zoetop finally did reset passwords for all Romwe customers in December 2020, the investigation found that it told customers their passwords expired after not being changed for a year.
The OAG investigation also found that Zoetop “failed to maintain reasonable security measures” at the time of the hack, including using insufficient password management systems and failing to monitor for security issues or have a comprehensive plan in place in case of a cyberattack.
Ok