A women’s fashion retailer SHEIN, also spelled SheIn, is a US-based online store that had apparently suffered a data breach somewhere in June 2018, but the company only discovered the breach in late August 2018. SHEIN stated that the intruders managed to gain access to customers’ email addresses and encrypted passwords.
When the data breach was discovered, SHEIN stated that the hackers managed to gain access to email addresses and encrypted passwords that were stored in the system, but the leaked data does not contain any signs of encryption – it is likely that the passwords were decrypted before publishing the data.
In this data breach, there is a very wide array of email providers being used. Lets take a look:
# | Email Domain | Quantity |
---|---|---|
1 | gmail.com | 13,679,190 |
2 | hotmail.com | 4,019,832 |
3 | Yahoo.com | 2,192,258 |
4 | icloud.com | 729,539 |
5 | HOTMAIL.FR | 528,368 |
6 | mail.ru | 526,108 |
7 | web.de | 403,258 |
8 | aol.com | 401,925 |
9 | outlook.com | 318,435 |
10 | hotmail.co.uk | 313,180 |
11 | gmx.de | 297,622 |
12 | orange.fr | 226,573 |
13 | yahoo.fr | 195,841 |
14 | yandex.ru | 182,469 |
15 | live.com | 156,084 |
16 | hotmail.de | 131,248 |
17 | hotmail.it | 110,296 |
18 | yahoo.de | 106,191 |
19 | yahoo.co.uk | 104,798 |
20 | live.fr | 104,342 |
21 | libero.it | 102,292 |
22 | googlemail.com | 97,320 |
23 | t-online.de | 95,561 |
24 | msn.com | 94,348 |
25 | laposte.net | 85,934 |
26 | comcast.net | 84,970 |
27 | hotmail.es | 83,819 |
28 | ymail.com | 81,731 |
29 | free.fr | 73,624 |
30 | outlook.fr | 72,114 |
31 | me.com | 68,649 |
32 | sfr.fr | 68,064 |
33 | wanadoo.fr | 63,208 |
34 | yahoo.com.tw | 63,159 |
35 | yahoo.es | 57,809 |
36 | live.co.uk | 52,470 |
37 | gamil.com | 51,544 |
38 | gmx.net | 46,147 |
39 | bk.ru | 45,914 |
40 | btinternet.com | 44,002 |
41 | gmail.con | 43,782 |
42 | sbcglobal.net | 38,499 |
43 | yahoo.it | 38,245 |
44 | freenet.de | 37,974 |
45 | att.net | 37,381 |
46 | yahoo.co.in | 35,944 |
47 | bigpond.com | 33,423 |
48 | wp.pl | 32,642 |
49 | live.de | 31,715 |
50 | live.it | 31,586 |
51 | mail.com | 31,243 |
52 | outlook.de | 30,401 |
53 | outlook.sa | 30,082 |
54 | list.ru | 28,461 |
55 | rambler.ru | 28,223 |
56 | rediffmail.com | 26,302 |
57 | inbox.ru | 26,123 |
58 | sky.com | 26,116 |
59 | neuf.fr | 25,320 |
60 | qq.com | 25,123 |
61 | rocketmail.com | 24,858 |
62 | yahoo.in | 24,577 |
63 | yahoo.com.au | 24,125 |
64 | verizon.net | 24,023 |
65 | windowslive.com | 23,852 |
66 | gmil.com | 23,120 |
67 | alice.it | 20,452 |
68 | hotmil.com | 19,979 |
69 | bellsouth.net | 19,002 |
70 | hotmail.con | 18,627 |
71 | cox.net | 18,206 |
72 | arcor.de | 18,109 |
73 | virgilio.it | 18,080 |
74 | aim.com | 17,910 |
75 | live.nl | 17,908 |
76 | live.com.au | 17,629 |
77 | gmai.com | 16,991 |
78 | yahoo.com.hk | 16,093 |
79 | outlook.es | 16,037 |
80 | bbox.fr | 14,134 |
81 | tiscali.it | 13,796 |
82 | seznam.cz | 12,907 |
83 | online.de | 12,612 |
84 | o2.pl | 12,477 |
85 | yahoo.com.br | 12,295 |
86 | email.com | 12,278 |
87 | outlook.it | 11,201 |
88 | live.com.mx | 11,021 |
89 | optonline.net | 9,594 |
90 | charter.net | 9,006 |
91 | interia.pl | 8,947 |
92 | yahoo.com.mx | 8,857 |
93 | mac.com | 8,549 |
94 | yahoo.ca | 8,492 |
95 | gmail.co | 8,491 |
96 | optusnet.com.au | 8,306 |
97 | abv.bg | 7,984 |
98 | ntlworld.com | 7,926 |
99 | live.se | 7,674 |
100 | ya.ru | 7,624 |
The length of the chosen email addresses in this data breach also varies widely – if we take a range from the smallest number to the largest we can see that:
Looking at the top-level domains (TLDs), we can also create a list of countries that SheIn users were using the service from:
# | Email Domain | Quantity | Purpose / Country |
---|---|---|---|
1 | .com | 17,699,022 | Commercial / United States |
2 | .edu | 1,813 | Education |
3 | .net | 85,934 | Network Infrastructure |
4 | .de | 403,258 | Germany |
5 | .fr | 754,941 | France |
6 | .au | 24,125 | Australia |
7 | .it | 110,296 | Italy |
8 | .ru | 526,108 | Russia |
9 | .uk | 313,180 | United Kingdom |
10 | .es | 83,819 | Spain |
11 | .pl | 45,119 | Poland |
12 | .con | 43,782 | None, probably misspelled |
13 | .br | 12,295 | Brazil |
14 | .ca | 8,492 | Canada |
15 | .nl | 17,908 | The Netherlands |
16 | .mx | 11,021 | Mexico |
17 | .co | 8,491 | Colombia |
18 | .no | 5,712 | Norway |
19 | .be | 2,130 | Belgium |
20 | .in | 35,944 | India |
21 | .se | 7,674 | Sweden |
22 | .at | 6,910 | Austria |
23 | .ch | 4,639 | Switzerland |
24 | .dk | 2,675 | Denmark |
25 | .nz | 2,321 | New Zealand |
26 | .pt | 2,243 | Portugal |
27 | .ar | 2,229 | Argentina |
28 | .tw | 63,159 | Taiwan |
29 | .ae | 1,532 | United Arab Emyrates |
30 | .cz | 12,907 | Czech Republic |
31 | .cn | 1,393 | China |
32 | .bg | 7,984 | Bulgaria |
33 | .gr | 4,178 | Greece |
34 | .cim | 3,815 | None, probably misspelled |
35 | .ua | 828 | Ukraine |
36 | .hu | 3,141 | Hungary |
37 | .eu | 2,393 | European Union |
38 | .cm | 1,945 | None, probably misspelled |
39 | .sk | 1,813 | Slovakia |
40 | .sa | 30,082 | Saudi Arabia |
41 | .ie | 1,496 | Ireland |
42 | .ro | 1,330 | Romania |
43 | .fm | 1,221 | Federated States of Micronesia |
44 | .id | 1,206 | Indonesia |
45 | .cl | 1,200 | Chile |
46 | .om | 1,188 | Oman |
47 | .lv | 6,980 | Latvia |
48 | .comm | 1,177 | None, probably misspelled |
49 | .me | 1,029 | Montenegro |
50 | .qa | 1,003 | Qatar |
51 | .clm | 853 | None, probably misspelled |
52 | .fi | 840 | Finland |
53 | .ee | 773 | Estonia |
54 | .ph | 2,847 | The Philippines |
55 | .by | 736 | Belarus |
56 | .cpm | 714 | None, probably misspelled |
57 | .cat | 703 | Catalonia |
58 | .hr | 699 | Croatia |
59 | .XOM | 621 | None, probably misspelled |
60 | .fe | 598 | Footballia |
61 | .vn | 2,206 | Vietnam |
62 | .cok | 586 | None, probably misspelled |
63 | .il | 2,202 | Israel |
64 | .te | 562 | None, probably misspelled |
65 | .jp | 1,928 | Japan |
66 | .come | 1,858 | None, probably misspelled |
67 | .vom | 1,615 | None, probably misspelled |
68 | .hk | 16,093 | Hong Kong |
69 | .col | 1,517 | None, probably misspelled |
70 | .sg | 1,464 | Singapore |
Here’s the letters email addresses begin with. If the analysis is being run on a database with duplicates, the results show that there are 29,026,175 email addresses that begin with letters. The most popular letter is R followed by the letter A, which is followed by the letter S. Email addresses beginning with letters contain 99.05978747356848% of the entire user base:
# | The letter an email address begins with | Quantity |
---|---|---|
1 | A | 3,206,739 |
2 | B | 1,187,451 |
3 | C | 1,770,137 |
4 | D | 1,195,226 |
5 | E | 1,053,108 |
6 | F | 670,340 |
7 | G | 842,864 |
8 | H | 872,318 |
9 | I | 567,572 |
10 | J | 1,497,023 |
11 | K | 1,524,405 |
12 | L | 1,795,120 |
13 | M | 3,133,130 |
14 | N | 1,267,323 |
15 | O | 300,603 |
16 | P | 997,513 |
17 | Q | 56,536 |
18 | R | 1,308,177 |
19 | S | 3,101,369 |
20 | T | 1,007,586 |
21 | U | 107,682 |
22 | V | 635,428 |
23 | W | 293,056 |
24 | X | 96,957 |
25 | Y | 306,122 |
26 | Z | 232,390 |
Now that letters have been covered, we could also take a look at the numbers. It should be noted that email addresses beginning with numbers are much less prevalent than those beginning with letters. Combined, there are just 213,390 email addresses that begin with numbers – that’s less than 1% of the entire user base. Email addresses beginning with numbers contain 0.7282519329186425% of the total entries in the SheIn data breach.
The number an email address begins with | Quantity |
---|---|
0 | 17,052 |
1 | 63,972 |
2 | 39,719 |
3 | 17,427 |
4 | 11,964 |
5 | 9,447 |
6 | 8,266 |
7 | 15,081 |
8 | 14,165 |
9 | 16,337 |
0.2119605935128775% of the email addresses in the SheIn data breach did not start with any numbers or letters – that’s exactly 62,108 accounts if we check the records against the database with duplicate entries or slightly more than 58,457 accounts if we check the records against the database without duplicate entries – the exact record count then would be 58,457.41329595996.
There is a very interesting password distribution in the SheIn data breach – there are hundreds of different passwords that have been used by multiple different people. Of course, there are the ordinary combinations, but there are also thousands of passwords like “sheinside” potentially meaning that the users who chose such a password probably thought of it on-the-spot or “shein18” and “Shein2018”, potentially meaning that the users created their accounts in 2018. There were also 293,688 users that used multiple empty spaces as their passwords. Here’s the list:
# | Password | Quantity |
---|---|---|
1 | 290,394 | |
2 | 123456 | 89,122 |
3 | 123456789 | 41,637 |
4 | 1234567890 | 22,968 |
5 | 12345678 | 20,673 |
6 | Shein123 | 13,773 |
7 | shopping | 11,664 |
8 | 1234567 | 11,634 |
9 | password | 11,298 |
10 | 123123 | 11,155 |
11 | aa123456 | 11,072 |
12 | sheinside | 10,063 |
13 | shein | 7,978 |
14 | 1234 | 7,297 |
15 | 12345 | 7,153 |
16 | 11223344 | 6,767 |
17 | shein1 | 6,679 |
18 | 112233 | 5,874 |
19 | 0987654321 | 5,415 |
20 | 111111 | 5,281 |
21 | 1122334455 | 5,071 |
22 | 123321 | 4,781 |
23 | Aa123123 | 4,742 |
24 | qwerty | 4,737 |
25 | Shein2018 | 4,715 |
26 | sheinshein | 4,403 |
27 | qwert | 3,949 |
28 | qwertyuiop | 3,904 |
29 | 123123123 | 3,902 |
30 | Aa112233 | 3,881 |
31 | Aa11223344 | 3,785 |
32 | 1234512345 | 3,737 |
33 | shein2017 | 3,682 |
34 | onedirection | 3,542 |
35 | password1 | 3,473 |
36 | iloveyou | 3,295 |
37 | 3,294 | |
38 | qwer1234 | 3,156 |
39 | 12344321 | 3,086 |
40 | azerty | 2,979 |
41 | 12345678910 | 2,934 |
42 | chocolate | 2,920 |
43 | motdepasse | 2,885 |
44 | abc123 | 2,784 |
45 | sunshine | 2,754 |
46 | princess | 2,745 |
47 | asDF1234 | 2,662 |
48 | asdfghjkl | 2,586 |
49 | 000000 | 2,567 |
50 | shein@123 | 2,554 |
51 | shein.com | 2,547 |
52 | loulou | 2,524 |
53 | SheIn2016 | 2,522 |
54 | Mm123456 | 2,515 |
55 | 1234554321 | 2,456 |
56 | as123456 | 2,401 |
57 | 987654321 | 2,399 |
58 | qwerty123 | 2,389 |
59 | shein1234 | 2,381 |
60 | justinbieber | 2,363 |
61 | 112233445566 | 2,354 |
62 | abcd1234 | 2,330 |
63 | shopping1 | 2,329 |
64 | chouchou | 2,313 |
65 | doudou | 2,289 |
66 | 654321 | 2,276 |
67 | passwort | 2,267 |
68 | hallo123 | 2,254 |
69 | chocolat | 2,246 |
70 | 121212 | 2,204 |
71 | forever21 | 2,176 |
72 | hellokitty | 2,165 |
73 | Aa12341234 | 2,126 |
74 | ichliebedich | 2,110 |
75 | clothes | 2,092 |
76 | ss123456 | 2,024 |
77 | fashion | 1,934 |
78 | incorrect | 1,888 |
79 | shopping123 | 1,881 |
80 | Aa123456789 | 1,877 |
81 | hello123 | 1,849 |
82 | 12345678900 | 1,842 |
83 | soleil | 1,778 |
84 | 12341234 | 1,766 |
85 | charlotte | 1,756 |
86 | compras | 1,735 |
87 | michelle | 1,715 |
88 | 11111111 | 1,707 |
89 | butterfly | 1,704 |
90 | Rr123456 | 1,701 |
91 | azertyuiop | 1,661 |
92 | shein18 | 1,651 |
93 | sheinpassword | 1,633 |
94 | Password123 | 1,621 |
95 | charlie | 1,620 |
96 | Aa1234567 | 1,618 |
97 | zxcvbnm | 1,600 |
98 | 20092012 | 1,592 |
99 | 123456aA | 1,590 |
100 | welcome1 | 1,586 |
It should also be noted that the system contained 3,294 one-character passwords meaning that it is probably safe to assume that SheIn did not implement many security rules to enforce password strength.
Judging by the passwords that the users chose, we can safely assume that the service has been in operation at least since 2015 and since then grown steadily – “shein2015” password has been chosen by 699 users, “shein2016” password has been chosen by 2,522 users, “shein2017” password has been chosen by 3,682 users and the “shein2018” password has been chosen by 4,715 users.
This allows us to make an assumption that the choices of year-based passwords grew by 1,823 users in 2016, by 1,160 users in 2017 and by 1,033 users in 2018. Average growth per year – 1338.666666666667 users who chose new year-based passwords, so we can assume that the service would have had approximately 2,372 new users who would have chosen new year-based passwords in 2019 and approximately 3,711 new users who would have chosen new year-based passwords in 2020.
More interesting password choices include one-character passwords like “&”, “S”, “43”, and “(“, the word “sonnenschein” has been used 1,356 times, “papillon” has been used 1,131 times, “1q2w3e4r5t” has been used 1,065 times and “ritinhasantos4” has been used 1,021 times.
We can also see that there are multiple passwords that have been used the same number of times – there are 73 of them:
# | Password | Quantity | Password Repeat Times |
---|---|---|---|
1 | estrella | 1,001 | 2 |
2 | 00000 | 1,060 | 2 |
3 | happy123 | 1,062 | 2 |
4 | ; | 1,095 | 2 |
5 | Iloveshein | 1,131 | 2 |
6 | Aa1122334455 | 1,356 | 2 |
7 | 10203040 | 616 | 3 |
8 | 123456788 | 619 | 2 |
9 | jesus123 | 625 | 2 |
10 | 999999 | 627 | 4 |
11 | samantha1 | 631 | 2 |
12 | 123123AA | 634 | 3 |
13 | chicken | 635 | 2 |
14 | 2 | 639 | 2 |
15 | Computer | 642 | 3 |
16 | Aa100100 | 648 | 3 |
17 | alessandro | 649 | 3 |
18 | Daisy123 | 652 | 4 |
19 | lolipop | 655 | 2 |
20 | family | 656 | 2 |
21 | purple123 | 657 | 2 |
22 | love2shop | 666 | 3 |
23 | ashley | 667 | 2 |
24 | monkey123 | 673 | 2 |
25 | ( | 676 | 2 |
26 | justine | 679 | 3 |
27 | 11223344556677 | 684 | 2 |
28 | angela | 692 | 2 |
29 | 123456789Aa | 697 | 2 |
30 | fuckyou | 698 | 2 |
31 | michelle1 | 699 | 2 |
32 | 224466 | 702 | 2 |
33 | 1234abcd | 705 | 2 |
34 | 7654321 | 712 | 2 |
35 | Mm11223344 | 715 | 2 |
36 | 123098 | 717 | 4 |
37 | aa12345 | 718 | 3 |
38 | 131313 | 720 | 3 |
39 | alessia | 721 | 2 |
40 | elizabeth1 | 724 | 2 |
41 | beatrice | 725 | 2 |
42 | cooper | 730 | 2 |
43 | a1234567 | 731 | 2 |
44 | buddy123 | 733 | 3 |
45 | amandine | 738 | 4 |
46 | motherlode | 739 | 2 |
47 | 090909 | 740 | 3 |
48 | fatima | 746 | 2 |
49 | banana | 751 | 2 |
50 | hannah123 | 754 | 2 |
51 | lovelove | 757 | 2 |
52 | barbie | 759 | 2 |
53 | 88888888 | 773 | 2 |
54 | asd123 | 779 | 3 |
55 | asdfgh | 783 | 2 |
56 | 112233445566778899 | 796 | 3 |
57 | 12121212 | 800 | 2 |
58 | pepper | 811 | 2 |
59 | 00000000 | 823 | 2 |
60 | 009988 | 824 | 3 |
61 | aB123456 | 842 | 2 |
62 | 123456a | 847 | 2 |
63 | 87654321 | 853 | 2 |
64 | cocacola | 860 | 2 |
65 | coucou | 874 | 2 |
66 | 123654 | 884 | 4 |
67 | 1 | 885 | 2 |
68 | lalala | 897 | 2 |
69 | d | 925 | 2 |
70 | 123455 | 952 | 2 |
71 | Asd12345 | 964 | 2 |
72 | marina | 981 | 2 |
73 | patricia | 998 | 2 |
Best guess would be that these passwords were created by users who had more than one account in the system and thus, the times passwords repeated would match the count of multiple accounts the user had.
Apart from this, there are also a lot of passwords that begin with alphabetical letters and numbers. Here is the list of passwords that begin with letters:
# | The letter the password begins with | Quantity |
---|---|---|
1 | A | 1,992,010 |
2 | B | 1,298,884 |
3 | C | 1,455,374 |
4 | D | 964,988 |
5 | E | 710,719 |
6 | F | 803,599 |
7 | G | 789,006 |
8 | H | 887,892 |
9 | I | 660,077 |
10 | J | 978,300 |
11 | K | 906,390 |
12 | L | 1,342,680 |
13 | M | 2,109,455 |
14 | N | 904,379 |
15 | O | 458,681 |
16 | P | 1,213,355 |
17 | Q | 349,112 |
18 | R | 940,811 |
19 | S | 2,286,583 |
20 | T | 955,001 |
21 | U | 289,858 |
22 | V | 536,327 |
23 | W | 492,077 |
24 | X | 255,748 |
25 | Y | 381,001 |
26 | Z | 391,859 |
Here is the list of passwords that begin with numbers:
The number the password begins with | Quantity |
---|---|
0 | 656,343 |
1 | 1,423,879 |
2 | 613,947 |
3 | 299,329 |
4 | 236,096 |
5 | 231,729 |
6 | 232,289 |
7 | 235,043 |
8 | 247,879 |
9 | 341,314 |
In the data dump there are 408,406 passwords that are less than or equal to 5 characters in length, 20,919,888 passwords that are less than or equal to 10 characters in length, 29,187,461 passwords that are less than or equal to 20 characters in length, 65,519 passwords that are more than or equal to 20 characters in length, 40,642 passwords that are more than or equal to 30 characters in length. There are even passwords that are more than or equal to 40 characters in length – the total count of such passwords is 48. It is very likely that the passwords that are more than or equal to 20 characters in length were generated by password managers.
To summarize, the SheIn data breach, although relatively small compared to the bigger ones, did bring a lot of damage to the company and to its customers. The good thing is that SheIn notified all of their customers that their data is at risk – they also collaborated with cybersecurity investigators who monitored the network and tried to ensure that future data breaches can be prevented.
A hacking group related to North Korea is exploiting a zero-day in the Chromium browser…
What are crypto bubbles, how do they form, and should you worry about them? Learn…
Is the crypto-engine.pro blog legit and should you trust this resource? Learn here!
Reside in Brazil and found that your Twitter account suspended? There’s a good reason for…
This blog covers the recent Black Hat USA 2024 (DEFCON 2024) conference and digs into…
The CEO of Telegram and Telegram Web, Pavel Durov, has been released from custody and…