The Romwe Breach Happened in 2018. The Data Just Resurfaced.

HEROIC analysts discovered the Romwe breach data resurfacing on dark web forums in late 2024, years after the original incident first occured in mid-2018. The breach exposed nearly 19.5 million customer records from the Hong Kong-based online fashion retailer. The stolen data went beyond the typical email and password combination, also including first names, last names, phone numbers, and IP addresses. Passwords were stored as salted SHA-1 hashes, a method that was already considered weak at the time and is now quite accessable to attackers with modern cracking tools.

Why Phone Numbers and IP Addresses Make This Breach More Dangerous

Many breaches leak only email addresses and passwords, which is already serious. The Romwe breach went further by including phone numbers and IP addresses alongside personal names. With a phone number, attackers can attempt SIM swapping attacks to hijack someone's mobile account and bypass two-factor authentication. IP addresses can help attackers understand where a user lives or works, making social engineering and targeted phishing far more convincing. When combined with a name and email, this data creates a detailed profile that makes it partcularly easy to deceive victims into revealing even more sensitive information.

What Was Exposed in the Romwe Breach

• Email Address
• First Name
• Last Name
• Phone Number
• IP Address
• Password Hash

Why the Romwe Breach Keeps Resurfacing Years Later

Data from the Romwe breach appeared in underground communities years after it was first stolen, which is a common pattern with large retail breaches. Attackers buy and sell breach data repeatedly, and older datasets get merged into fresh credential stuffing lists. Because password reuse remains widespread, a leaked password from 2018 may still work on a victim's current bank account, email, or work login. Identity theft, financial fraud, and account takeover attacks all remain very real risks for anyone whose data was part of this breach. The longer time passes without action, the more opportunities attackers have to exploit the exposure.

How a Database Breach Works

A database breach happens when an unauthorized person gains access to a company's stored records, usually by exploiting a software flaw, stolen login credentials, or a misconfigured server. Once inside, attackers silently copy the data without disrupting the service, meaning the company and its users often have no idea the theft took place. In Romwe's case, the stolen records included rich personal information that went beyond basic account details. This type of deep data theft gives attackers multiple ways to monetize the information, from selling it outright to using it directly in targeted attacks.

Check If Your Data Was Exposed

HEROIC provides a free breach scanner backed by more than 400 billion compromised records. If your email address or personal details were part of the Romwe breach or any other incident, you can find out right now. Visit the HEROIC breach scanner to check your exposure and take steps to protect your accounts before your information is used against you.