Shein Class Action Says Hackers Stole 6M Customers’ Info

A consumer alleges in a class action lawsuit that Shein, a prominent fashion e-commerce platform, was subject to a data breach that exposed the personal information of over 6 million customers.

Lead plaintiff Rosalie Golbahar alleges in her class action lawsuit that the e-commerce platform failed to properly protect customer data – making it a prime target for hackers. She says Shein’s lax security policies exposed consumers to identity thieves and fraud.

Golbahar alleges that she was a Shein customer and in September of 2018 she was notified of about $10,000 in fraudulent charges on the credit card she used with the e-commerce retailer. Golbahar alleges that it took her over twenty hours to contact various financial institutions and cancel her credit card to deal with the identity theft.

According to the class action lawsuit, Shein found out on Aug. 22, 2018 that the private information of approximately 6.4 million customers had been accessed in a data breach. The breach occurred from June until August of this year.

Shein allegedly failed to tell consumers about the alleged data breach until Sept. 21, 2018. At that point, Shein notified consumers that hackers had accessed a “back door” to their system, but provided few details, says the class action lawsuit.

Although the company told customers additional information would be forthcoming, the class action lawsuit alleges that Shein has failed to provide any other details. In fact, the company has allegedly scrubbed any references to the data breach from its website.

“Since the Data Breach, SHEIN has eliminated any reference or notification of the breach from the homepage of the SHEIN website, likely due to the potential negative impact such notice would have on potential shoppers during the holiday season,” contends the class action lawsuit.

According to the class action lawsuit, Shein was less than forthcoming about whether customers’ financial information was disclosed in the data breach.

“While SHEIN claims it has not seen evidence that credit card information was stolen in the Data Breach, SHEIN could not definitely disclaim that credit card information was not stolen because SHEIN ‘typically does not store credit card information on its systems,’” states the class action lawsuit.

In fact, according to the complaint, Shein admits that it does collect personal information, including payment data, account and authentication information, along with shipping and billing details in its own privacy policy.

Even without credit and debit card numbers, Shein customers face the risk of identity theft, argues the class action lawsuit.

“[W]ith the known Customer Data stolen, criminals can engage in ‘credential stuffing,’ a type of cyberattack where stolen account credentials (typically usernames, emails, and passwords) are used to gain unauthorized access to a user’s other online accounts through large-scale automated login requests directed against a web application,” notes the class action lawsuit.

In addition to failing to adequately protect consumer data, the class action lawsuit alleges that Shein’s continued failure to provide additional details about the data breach leaves consumers at risk.

The Shein class action lawsuit alleges that Class Members are now vulnerable to numerous injuries, including unauthorized charges, theft, costs to protect themselves from fraud, credit or debit card freezes, and time and money to detect and mitigate the use of their information by identity thieves.

The plaintiff is represented by Benjamin Heikali and Joshua Nassir of Farqui & Farqui LLP.

The Shein Class Action Lawsuit is Golbahar v. Shein Fashion Group Inc., Case No. 2:18-cv-10340 in the U.S. District Court Central District of California.