HackingRetail & ConsumerRetailStolen CredentialsCustomer Data InvolvedCredentialsPIILowActive

Shein

bd_9cc81320a65d2dcc · schema v1 · pii pii-v1

Severity

Low

Discovered

Aug 22, 2018

Filed

Sep 21, 2018

To disclose

4 weeks

Affected

Not disclosed

Linked

6 filings

Confidence

66%

Full breach record for Shein →2 incidents on file

SHEIN notified Montana customers of a cyberattack on August 22, 2018, where intruders stole email addresses and encrypted passwords. SHEIN engaged forensic and legal firms, removed malware, and closed attacker entry points. Affected customers were offered LifeLock monitoring services.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 4 weeks / 30 days

Aug 22, 2018

Discovered

Sep 21, 2018

Filed

vs. sector median

3 wks faster

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

New Hampshire State AGbd_ad7ee2e7eff93f552018-09-21Verified
Massachusetts State AGbd_8cdd444d13b362af2018-10-10 · +19dVerified
California State AGbd_ec80e448916c7d162018-10-10 · +19dVerified
Washington State AGbd_163ba3e0e55e255c2018-10-11 · +20dVerified

Show 1 more filing ↓up to 20d gap

Oregon State AGbd_62e301b01675a2e52018-10-11 · +20dVerified

Name: Shein
norm: shein
Domain: shein.com

Name: Shein
norm: shein
Domain: shein.com
Industry: Retail & Consumerllm

Discovered: Aug 22, 2018
Materiality determined: —
Notification sent: Aug 22, 2018
Affected individuals: Not disclosed
Data types: CredentialsPII
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Initial access: valid_credentials

During the incident: Employed a leading international forensic cybersecurity firm
Employed an international law firm
SHEIN servers have been scanned and malware found on the servers has been removed
“Back door” entry points to the servers opened by the attackers have been closed and removed
Offering concerned customers identity theft monitoring services via LifeLock DefenderTM
Changes made: SHEIN and its IT staff, as well as its cybersecurity investigators, will continue to closely monitor the network and servers
Implement new safeguards to prevent any future breaches
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 4 weeks(30 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

New Hampshire State AGSep 21 · first

Montana State AGSep 21 · first · this page

Massachusetts State AG+19d

California State AG+19d

Washington State AG+20d

Oregon State AG+20d

Pattern: first filing Sep 21 (NH), last Oct 11 (OR) — a 20-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Shein-1.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 21, 2018
Raw hash: fd71e1eef2c541629b113df3e3705041f2393b7aa08c743e59174d02d0642e77

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityShein

Victim entityShein

Incidentdiscovered Aug 22, 2018

Stated responseEmployed a leading international forensic cybersecurity firm

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov