HackingRetail & ConsumerRetailStolen CredentialsData ExfiltratedTargetedPIICredentialsHighActive

Shein USA

bd_2f259e9c064b4d1f · schema v1 · pii pii-v1

Severity

High

Discovered

Aug 22, 2018

Filed

Oct 15, 2018

To disclose

8 weeks

Affected · nationwide

6,420,00018,371 in this filing

Confidence

64%

Full breach record for Shein USA →

SHEIN notified customers of a data breach affecting approximately 6.42 million individuals. The incident, occurring between June and August 2018, involved unauthorized access to customer email addresses and encrypted passwords. SHEIN engaged forensic investigators, removed malware, closed backdoors, and offered one year of identity theft monitoring.

J jump to incidentP pin to compareR raw source

South Carolina clock✓ SC CRA notice due8 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 82 days

discovery → filing · 8 weeks / 54 days

Jun 1, 2018

Begins

Aug 22, 2018

Discovered

Oct 15, 2018

Filed

vs. sector median

on median

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed6,420,000 affectedView incident

Name: Shein USA
norm: shein usa
Domain: shein-usa.com

Name: Shein USA
norm: shein usa
Domain: shein-usa.com
Industry: Retail & Consumerllm

Discovered: Aug 22, 2018
Breach occurred: Jun 1, 2018 – Aug 1, 2018
Undetected for: 82 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 21, 2018
Affected individuals: 6,420,000state + nationwide
Data types: PIICredentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notifying proper authorities
Initial access: exploit_public_facing

During the incident: Hired a leading international forensic cybersecurity firm
Hired an international law firm to conduct a thorough investigation
Continued to closely monitor the network and servers
Scanned SHEIN servers and removed malware
Closed and removed "back door" entry points
Notifying proper authorities and affected customers
Sending customer notices with instructions for resetting passwords
Offering one year of identity theft monitoring to affected customers
Changes made: Implementing new safeguards to prevent any future breaches
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(54 days from discovery to filing)
Compliance flags: SC CRA notice due
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2018/Shein.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 15, 2018
Raw hash: d0f352063fd3c7ba24a79fc477a88f04060cf5dbac60243ae41d946e35cab0aa

Reporting entityShein USA

Victim entityShein USA

Incidentdiscovered Aug 22, 2018

Stated responseHired a leading international forensic cybersecurity firm

ComplianceSC CRA notice due

Extraction provenanceno artifact recorded

Source provenanceconsumer.sc.gov