A $1.9 million fine was imposed on Zoetop, the parent company for the massive retailers Romwe and Shein, for failing to properly notify customers of a data breach that reportedly affected millions of users.
In 2018, 39 million Shein accounts' login information was stolen after its parent business, Zoetop, was attacked by hackers.
Letitia James, the attorney general for New York, claimed that Zoetop had exaggerated the scope of the breach and had informed just a portion of the consumers who were impacted.
According to the office of the New York Attorney General, Zoetop failed to protect consumer data and failed to notify millions of account holders that their personal information had been compromised.
"To safeguard customers from fraud and identity theft, Shein and Romwe must tighten their cybersecurity protocols. This agreement should serve as a strong reminder to businesses that they need to improve their digital security protocols and communicate openly with customers, anything less won't be accepted" Letitia James, the attorney general of New York, said.
More generally, according to Patrick Wragg, manager of cyber incident response at Integrity360, there are significant risks associated with a company failing to disclose that it has been attacked.
Letitia James alleged that Zoetop had exaggerated the scope of the hack, first claiming that only 6.42 million Shein accounts had been compromised. The majority of the 39 million impacted account holders were not informed, and all of those accounts did not require a forced password reset.
Romwe and Shein have grown to be well-liked online shopping venues for 'Gen Z' and millennial consumers looking for affordable, trendy fashion items.
However, Ms. James claimed that the companies' lax cyber-security made it simple for hackers to steal customers' personal information. To safeguard customers, the attorney general urged the businesses to 'button up their cyber-security measures.'
Shein fully cooperated with the New York attorney general, according to a spokeswoman, and they are happy with how the situation turned out.
The revelation about Zoetop follows two data breaches in Australia that had an impact on Singtel subsidiary companies.
