Romwe Data Breach

What happened

In mid-2018, the Hong Kong-based retailer Romwe suffered a data breach which exposed almost 20 million customers. The data was subsequently sold online and includes names, phone numbers, email and IP addresses, customer geographic locations and passwords stored as salted SHA-1 hashes. The data was provided to HIBP by dehashed.com.

Exposed data

Recommended actions

• Change your Romwe password immediately, and update it anywhere you reused the same password.
• Enable two-factor authentication on the affected account and on your critical services (email, banking).
• Stay alert for smishing (SMS phishing) and SIM-swap attempts using your phone number.
• Exposed identity data raises identity-theft risk — consider credit monitoring or a credit freeze.
• Check whether your email address appears in this breach on haveibeenpwned.com.