SHEIN.com Data Breach Analysis
Tags: security, webdev, programming, tutorial
Published: 2022-11-12 11:00:00

<!-- wp:heading -->
<h2>Foreword</h2>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>A women's fashion retailer SHEIN, also spelled SheIn, is a US-based online store that had apparently suffered a data breach somewhere in June 2018, but the company only discovered the breach in late August 2018. SHEIN stated that the intruders managed to gain access to customers' email addresses and encrypted passwords.</p>
<!-- /wp:paragraph -->

<!-- wp:heading -->
<h2>What data is at risk?</h2>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>When the data breach was discovered, SHEIN stated that the hackers managed to gain access to email addresses and encrypted passwords that were stored in the system, but the leaked data does not contain any signs of encryption - <em>it is likely that the passwords were decrypted before publishing the data</em>.</p>
<!-- /wp:paragraph -->

<!-- wp:heading -->
<h2>Email addresses</h2>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>In this data breach, there is a very wide array of email providers being used. Lets take a look:</p>
<!-- /wp:paragraph -->

<!-- wp:table -->
<figure class="wp-block-table"><table><tbody><tr><th>#</th><th>Email Domain</th><th>Quantity</th></tr><tr><td>1</td><td>gmail.com</td><td>13,679,190</td></tr><tr><td>2</td><td>hotmail.com</td><td>4,019,832</td></tr><tr><td>3</td><td>Yahoo.com</td><td>2,192,258</td></tr><tr><td>4</td><td>icloud.com</td><td>729,539</td></tr><tr><td>5</td><td>HOTMAIL.FR</td><td>528,368</td></tr><tr><td>6</td><td>mail.ru</td><td>526,108</td></tr><tr><td>7</td><td>web.de</td><td>403,258</td></tr><tr><td>8</td><td>aol.com</td><td>401,925</td></tr><tr><td>9</td><td>outlook.com</td><td>318,435</td></tr><tr><td>10</td><td>hotmail.co.uk</td><td>313,180</td></tr><tr><td>11</td><td>gmx.de</td><td>297,622</td></tr><tr><td>12</td><td>orange.fr</td><td>226,573</td></tr><tr><td>13</td><td>yahoo.fr</td><td>195,841</td></tr><tr><td>14</td><td>yandex.ru</td><td>182,469</td></tr><tr><td>15</td><td>live.com</td><td>156,084</td></tr><tr><td>16</td><td>hotmail.de</td><td>131,248</td></tr><tr><td>17</td><td>hotmail.it</td><td>110,296</td></tr><tr><td>18</td><td>yahoo.de</td><td>106,191</td></tr><tr><td>19</td><td>yahoo.co.uk</td><td>104,798</td></tr><tr><td>20</td><td>live.fr</td><td>104,342</td></tr><tr><td>21</td><td>libero.it</td><td>102,292</td></tr><tr><td>22</td><td>googlemail.com</td><td>97,320</td></tr><tr><td>23</td><td>t-online.de</td><td>95,561</td></tr><tr><td>24</td><td>msn.com</td><td>94,348</td></tr><tr><td>25</td><td>laposte.net</td><td>85,934</td></tr><tr><td>26</td><td>comcast.net</td><td>84,970</td></tr><tr><td>27</td><td>hotmail.es</td><td>83,819</td></tr><tr><td>28</td><td>ymail.com</td><td>81,731</td></tr><tr><td>29</td><td>free.fr</td><td>73,624</td></tr><tr><td>30</td><td>outlook.fr</td><td>72,114</td></tr><tr><td>31</td><td>me.com</td><td>68,649</td></tr><tr><td>32</td><td>sfr.fr</td><td>68,064</td></tr><tr><td>33</td><td>wanadoo.fr</td><td>63,208</td></tr><tr><td>34</td><td>yahoo.com.tw</td><td>63,159</td></tr><tr><td>35</td><td>yahoo.es</td><td>57,809</td></tr><tr><td>36</td><td>live.co.uk</td><td>52,470</td></tr><tr><td>37</td><td>gamil.com</td><td>51,544</td></tr><tr><td>38</td><td>gmx.net</td><td>46,147</td></tr><tr><td>39</td><td>bk.ru</td><td>45,914</td></tr><tr><td>40</td><td>btinternet.com</td><td>44,002</td></tr><tr><td>41</td><td>gmail.con</td><td>43,782</td></tr><tr><td>42</td><td>sbcglobal.net</td><td>38,499</td></tr><tr><td>43</td><td>yahoo.it</td><td>38,245</td></tr><tr><td>44</td><td>freenet.de</td><td>37,974</td></tr><tr><td>45</td><td>att.net</td><td>37,381</td></tr><tr><td>46</td><td>yahoo.co.in</td><td>35,944</td></tr><tr><td>47</td><td>bigpond.com</td><td>33,423</td></tr><tr><td>48</td><td>wp.pl</td><td>32,642</td></tr><tr><td>49</td><td>live.de</td><td>31,715</td></tr><tr><td>50</td><td>live.it</td><td>31,586</td></tr><tr><td>51</td><td>mail.com</td><td>31,243</td></tr><tr><td>52</td><td>outlook.de</td><td>30,401</td></tr><tr><td>53</td><td>outlook.sa</td><td>30,082</td></tr><tr><td>54</td><td>list.ru</td><td>28,461</td></tr><tr><td>55</td><td>rambler.ru</td><td>28,223</td></tr><tr><td>56</td><td>rediffmail.com</td><td>26,302</td></tr><tr><td>57</td><td>inbox.ru</td><td>26,123</td></tr><tr><td>58</td><td>sky.com</td><td>26,116</td></tr><tr><td>59</td><td>neuf.fr</td><td>25,320</td></tr><tr><td>60</td><td>qq.com</td><td>25,123</td></tr><tr><td>61</td><td>rocketmail.com</td><td>24,858</td></tr><tr><td>62</td><td>yahoo.in</td><td>24,577</td></tr><tr><td>63</td><td>yahoo.com.au</td><td>24,125</td></tr><tr><td>64</td><td>verizon.net</td><td>24,023</td></tr><tr><td>65</td><td>windowslive.com</td><td>23,852</td></tr><tr><td>66</td><td>gmil.com</td><td>23,120</td></tr><tr><td>67</td><td>alice.it</td><td>20,452</td></tr><tr><td>68</td><td>hotmil.com</td><td>19,979</td></tr><tr><td>69</td><td>bellsouth.net</td><td>19,002</td></tr><tr><td>70</td><td>hotmail.con</td><td>18,627</td></tr><tr><td>71</td><td>cox.net</td><td>18,206</td></tr><tr><td>72</td><td>arcor.de</td><td>18,109</td></tr><tr><td>73</td><td>virgilio.it</td><td>18,080</td></tr><tr><td>74</td><td>aim.com</td><td>17,910</td></tr><tr><td>75</td><td>live.nl</td><td>17,908</td></tr><tr><td>76</td><td>live.com.au</td><td>17,629</td></tr><tr><td>77</td><td>gmai.com</td><td>16,991</td></tr><tr><td>78</td><td>yahoo.com.hk</td><td>16,093</td></tr><tr><td>79</td><td>outlook.es</td><td>16,037</td></tr><tr><td>80</td><td>bbox.fr</td><td>14,134</td></tr><tr><td>81</td><td>tiscali.it</td><td>13,796</td></tr><tr><td>82</td><td>seznam.cz</td><td>12,907</td></tr><tr><td>83</td><td>online.de</td><td>12,612</td></tr><tr><td>84</td><td>o2.pl</td><td>12,477</td></tr><tr><td>85</td><td>yahoo.com.br</td><td>12,295</td></tr><tr><td>86</td><td>email.com</td><td>12,278</td></tr><tr><td>87</td><td>outlook.it</td><td>11,201</td></tr><tr><td>88</td><td>live.com.mx</td><td>11,021</td></tr><tr><td>89</td><td>optonline.net</td><td>9,594</td></tr><tr><td>90</td><td>charter.net</td><td>9,006</td></tr><tr><td>91</td><td>interia.pl</td><td>8,947</td></tr><tr><td>92</td><td>yahoo.com.mx</td><td>8,857</td></tr><tr><td>93</td><td>mac.com</td><td>8,549</td></tr><tr><td>94</td><td>yahoo.ca</td><td>8,492</td></tr><tr><td>95</td><td>gmail.co</td><td>8,491</td></tr><tr><td>96</td><td>optusnet.com.au</td><td>8,306</td></tr><tr><td>97</td><td>abv.bg</td><td>7,984</td></tr><tr><td>98</td><td>ntlworld.com</td><td>7,926</td></tr><tr><td>99</td><td>live.se</td><td>7,674</td></tr><tr><td>100</td><td>ya.ru</td><td>7,624</td></tr></tbody></table></figure>
<!-- /wp:table -->

<!-- wp:paragraph -->
<p>The length of the chosen email addresses in this data breach also varies widely - if we take a range from the smallest number to the largest we can see that:</p>
<!-- /wp:paragraph -->

<!-- wp:list -->
<ul><li>The smallest amount - <strong>7</strong> emails were more than or equal to <strong>100</strong> characters in length;</li><li>There's <strong>11</strong> emails which were less than or equal to <strong>5</strong> characters in length;</li><li><strong>13</strong> emails which contained more than or equal to <strong>90</strong> characters in length;</li><li><strong>25</strong> emails which contained more than or equal to <strong>80</strong> characters in length;</li><li><strong>117</strong> emails which contained more than or equal to <strong>70</strong> characters in length;</li><li><strong>178</strong> emails which contained more than or equal to <strong>60</strong> characters in length;</li><li><strong>385</strong> emails which contained more than or equal to <strong>50</strong> characters in length;</li><li><strong>10,183</strong> emails which contained more than or equal to <strong>40</strong> characters in length;</li><li><strong>16,755</strong> emails which contained less than or equal to <strong>10</strong> characters in length;</li><li><strong>843,073</strong> emails which contained more than or equal to <strong>30</strong> characters in length;</li><li><strong>9,848,312</strong> emails which contained less than or equal to <strong>20</strong> characters in length;</li><li><strong>22,322,666</strong> emails which contained more than or equal to <strong>20</strong> characters in length.</li></ul>
<!-- /wp:list -->

<!-- wp:paragraph -->
<p>Looking at the top-level domains (TLDs), we can also create a list of countries that SheIn users were using the service from:</p>
<!-- /wp:paragraph -->

<!-- wp:table -->
<figure class="wp-block-table"><table><tbody><tr><th>#</th><th>Email Domain</th><th>Quantity</th><th>Purpose / Country</th></tr><tr><td>1</td><td>.com</td><td>17,699,022</td><td>Commercial / United States</td></tr><tr><td>2</td><td>.edu</td><td>1,813</td><td>Education</td></tr><tr><td>3</td><td>.net</td><td>85,934</td><td>Network Infrastructure</td></tr><tr><td>4</td><td>.de</td><td>403,258</td><td>Germany</td></tr><tr><td>5</td><td>.fr</td><td>754,941</td><td>France</td></tr><tr><td>6</td><td>.au</td><td>24,125</td><td>Australia</td></tr><tr><td>7</td><td>.it</td><td>110,296</td><td>Italy</td></tr><tr><td>8</td><td>.ru</td><td>526,108</td><td>Russia</td></tr><tr><td>9</td><td>.uk</td><td>313,180</td><td>United Kingdom</td></tr><tr><td>10</td><td>.es</td><td>83,819</td><td>Spain</td></tr><tr><td>11</td><td>.pl</td><td>45,119</td><td>Poland</td></tr><tr><td>12</td><td>.con</td><td>43,782</td><td>None, probably misspelled</td></tr><tr><td>13</td><td>.br</td><td>12,295</td><td>Brazil</td></tr><tr><td>14</td><td>.ca</td><td>8,492</td><td>Canada</td></tr><tr><td>15</td><td>.nl</td><td>17,908</td><td>The Netherlands</td></tr><tr><td>16</td><td>.mx</td><td>11,021</td><td>Mexico</td></tr><tr><td>17</td><td>.co</td><td>8,491</td><td>Colombia</td></tr><tr><td>18</td><td>.no</td><td>5,712</td><td>Norway</td></tr><tr><td>19</td><td>.be</td><td>2,130</td><td>Belgium</td></tr><tr><td>20</td><td>.in</td><td>35,944</td><td>India</td></tr><tr><td>21</td><td>.se</td><td>7,674</td><td>Sweden</td></tr><tr><td>22</td><td>.at</td><td>6,910</td><td>Austria</td></tr><tr><td>23</td><td>.ch</td><td>4,639</td><td>Switzerland</td></tr><tr><td>24</td><td>.dk</td><td>2,675</td><td>Denmark</td></tr><tr><td>25</td><td>.nz</td><td>2,321</td><td>New Zealand</td></tr><tr><td>26</td><td>.pt</td><td>2,243</td><td>Portugal</td></tr><tr><td>27</td><td>.ar</td><td>2,229</td><td>Argentina</td></tr><tr><td>28</td><td>.tw</td><td>63,159</td><td>Taiwan</td></tr><tr><td>29</td><td>.ae</td><td>1,532</td><td>United Arab Emyrates</td></tr><tr><td>30</td><td>.cz</td><td>12,907</td><td>Czech Republic</td></tr><tr><td>31</td><td>.cn</td><td>1,393</td><td>China</td></tr><tr><td>32</td><td>.bg</td><td>7,984</td><td>Bulgaria</td></tr><tr><td>33</td><td>.gr</td><td>4,178</td><td>Greece</td></tr><tr><td>34</td><td>.cim</td><td>3,815</td><td>None, probably misspelled</td></tr><tr><td>35</td><td>.ua</td><td>828</td><td>Ukraine</td></tr><tr><td>36</td><td>.hu</td><td>3,141</td><td>Hungary</td></tr><tr><td>37</td><td>.eu</td><td>2,393</td><td>European Union</td></tr><tr><td>38</td><td>.cm</td><td>1,945</td><td>None, probably misspelled</td></tr><tr><td>39</td><td>.sk</td><td>1,813</td><td>Slovakia</td></tr><tr><td>40</td><td>.sa</td><td>30,082</td><td>Saudi Arabia</td></tr><tr><td>41</td><td>.ie</td><td>1,496</td><td>Ireland</td></tr><tr><td>42</td><td>.ro</td><td>1,330</td><td>Romania</td></tr><tr><td>43</td><td>.fm</td><td>1,221</td><td>Federated States of Micronesia</td></tr><tr><td>44</td><td>.id</td><td>1,206</td><td>Indonesia</td></tr><tr><td>45</td><td>.cl</td><td>1,200</td><td>Chile</td></tr><tr><td>46</td><td>.om</td><td>1,188</td><td>Oman</td></tr><tr><td>47</td><td>.lv</td><td>6,980</td><td>Latvia</td></tr><tr><td>48</td><td>.comm</td><td>1,177</td><td>None, probably misspelled</td></tr><tr><td>49</td><td>.me</td><td>1,029</td><td>Montenegro</td></tr><tr><td>50</td><td>.qa</td><td>1,003</td><td>Qatar</td></tr><tr><td>51</td><td>.clm</td><td>853</td><td>None, probably misspelled</td></tr><tr><td>52</td><td>.fi</td><td>840</td><td>Finland</td></tr><tr><td>53</td><td>.ee</td><td>773</td><td>Estonia</td></tr><tr><td>54</td><td>.ph</td><td>2,847</td><td>The Philippines</td></tr><tr><td>55</td><td>.by</td><td>736</td><td>Belarus</td></tr><tr><td>56</td><td>.cpm</td><td>714</td><td>None, probably misspelled</td></tr><tr><td>57</td><td>.cat</td><td>703</td><td>Catalonia</td></tr><tr><td>58</td><td>.hr</td><td>699</td><td>Croatia</td></tr><tr><td>59</td><td>.XOM</td><td>621</td><td>None, probably misspelled</td></tr><tr><td>60</td><td>.fe</td><td>598</td><td>Footballia</td></tr><tr><td>61</td><td>.vn</td><td>2,206</td><td>Vietnam</td></tr><tr><td>62</td><td>.cok</td><td>586</td><td>None, probably misspelled</td></tr><tr><td>63</td><td>.il</td><td>2,202</td><td>Israel</td></tr><tr><td>64</td><td>.te</td><td>562</td><td>None, probably misspelled</td></tr><tr><td>65</td><td>.jp</td><td>1,928</td><td>Japan</td></tr><tr><td>66</td><td>.come</td><td>1,858</td><td>None, probably misspelled</td></tr><tr><td>67</td><td>.vom</td><td>1,615</td><td>None, probably misspelled</td></tr><tr><td>68</td><td>.hk</td><td>16,093</td><td>Hong Kong</td></tr><tr><td>69</td><td>.col</td><td>1,517</td><td>None, probably misspelled</td></tr><tr><td>70</td><td>.sg</td><td>1,464</td><td>Singapore</td></tr></tbody></table></figure>
<!-- /wp:table -->

<!-- wp:paragraph -->
<p>Here's the letters email addresses begin with. If the analysis is being run on a database with duplicates, the results show that there are <strong>29,026,175</strong> email addresses that begin with letters. The most popular letter is R followed by the letter A, which is followed by the letter S. Email addresses beginning with letters contain <strong>99.05978747356848%</strong> of the entire user base:</p>
<!-- /wp:paragraph -->

<!-- wp:table -->
<figure class="wp-block-table"><table><tbody><tr><th>#</th><th>The letter an email address begins with</th><th>Quantity</th></tr><tr><td>1</td><td>A</td><td>3,206,739</td></tr><tr><td>2</td><td>B</td><td>1,187,451</td></tr><tr><td>3</td><td>C</td><td>1,770,137</td></tr><tr><td>4</td><td>D</td><td>1,195,226</td></tr><tr><td>5</td><td>E</td><td>1,053,108</td></tr><tr><td>6</td><td>F</td><td>670,340</td></tr><tr><td>7</td><td>G</td><td>842,864</td></tr><tr><td>8</td><td>H</td><td>872,318</td></tr><tr><td>9</td><td>I</td><td>567,572</td></tr><tr><td>10</td><td>J</td><td>1,497,023</td></tr><tr><td>11</td><td>K</td><td>1,524,405</td></tr><tr><td>12</td><td>L</td><td>1,795,120</td></tr><tr><td>13</td><td>M</td><td>3,133,130</td></tr><tr><td>14</td><td>N</td><td>1,267,323</td></tr><tr><td>15</td><td>O</td><td>300,603</td></tr><tr><td>16</td><td>P</td><td>997,513</td></tr><tr><td>17</td><td>Q</td><td>56,536</td></tr><tr><td>18</td><td>R</td><td>1,308,177</td></tr><tr><td>19</td><td>S</td><td>3,101,369</td></tr><tr><td>20</td><td>T</td><td>1,007,586</td></tr><tr><td>21</td><td>U</td><td>107,682</td></tr><tr><td>22</td><td>V</td><td>635,428</td></tr><tr><td>23</td><td>W</td><td>293,056</td></tr><tr><td>24</td><td>X</td><td>96,957</td></tr><tr><td>25</td><td>Y</td><td>306,122</td></tr><tr><td>26</td><td>Z</td><td>232,390</td></tr></tbody></table></figure>
<!-- /wp:table -->

<!-- wp:paragraph -->
<p>Now that letters have been covered, we could also take a look at the numbers. It should be noted that email addresses beginning with numbers are much less prevalent than those beginning with letters. Combined, there are just <strong>213,390</strong> email addresses that begin with numbers - <em>that's less than 1% of the entire user base</em>. Email addresses beginning with numbers contain <strong>0.7282519329186425%</strong> of the total entries in the SheIn data breach.</p>
<!-- /wp:paragraph -->

<!-- wp:table -->
<figure class="wp-block-table"><table><tbody><tr><th>The number an email address begins with</th><th>Quantity</th></tr><tr><td>0</td><td>17,052</td></tr><tr><td>1</td><td>63,972</td></tr><tr><td>2</td><td>39,719</td></tr><tr><td>3</td><td>17,427</td></tr><tr><td>4</td><td>11,964</td></tr><tr><td>5</td><td>9,447</td></tr><tr><td>6</td><td>8,266</td></tr><tr><td>7</td><td>15,081</td></tr><tr><td>8</td><td>14,165</td></tr><tr><td>9</td><td>16,337</td></tr></tbody></table></figure>
<!-- /wp:table -->

<!-- wp:paragraph -->
<p><strong>0.2119605935128775%</strong> of the email addresses in the SheIn data breach did not start with any numbers or letters - that's exactly <strong>62,108</strong> accounts if we check the records against the database with duplicate entries or slightly more than <strong>58,457</strong> accounts if we check the records against the database without duplicate entries -  the exact record count then would be <strong>58,457.41329595996</strong>.</p>
<!-- /wp:paragraph -->

<!-- wp:heading -->
<h2>Passwords</h2>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>There is a very interesting password distribution in the SheIn data breach - there are hundreds of different passwords that have been used by multiple different people. Of course, there are the ordinary combinations, but there are also thousands of passwords like "sheinside" potentially meaning that the users who chose such a password probably thought of it on-the-spot or "shein18" and "Shein2018", potentially meaning that the users created their accounts in 2018. There were also 293,688 users that used multiple empty spaces as their passwords. Here's the list:</p>
<!-- /wp:paragraph -->

<!-- wp:table -->
<figure class="wp-block-table"><table><tbody><tr><th>#</th><th>Password</th><th>Quantity</th></tr><tr><td>1</td><td></td><td>290,394</td></tr><tr><td>2</td><td>123456</td><td>89,122</td></tr><tr><td>3</td><td>123456789</td><td>41,637</td></tr><tr><td>4</td><td>1234567890</td><td>22,968</td></tr><tr><td>5</td><td>12345678</td><td>20,673</td></tr><tr><td>6</td><td>Shein123</td><td>13,773</td></tr><tr><td>7</td><td>shopping</td><td>11,664</td></tr><tr><td>8</td><td>1234567</td><td>11,634</td></tr><tr><td>9</td><td>password</td><td>11,298</td></tr><tr><td>10</td><td>123123</td><td>11,155</td></tr><tr><td>11</td><td>aa123456</td><td>11,072</td></tr><tr><td>12</td><td>sheinside</td><td>10,063</td></tr><tr><td>13</td><td>shein</td><td>7,978</td></tr><tr><td>14</td><td>1234</td><td>7,297</td></tr><tr><td>15</td><td>12345</td><td>7,153</td></tr><tr><td>16</td><td>11223344</td><td>6,767</td></tr><tr><td>17</td><td>shein1</td><td>6,679</td></tr><tr><td>18</td><td>112233</td><td>5,874</td></tr><tr><td>19</td><td>0987654321</td><td>5,415</td></tr><tr><td>20</td><td>111111</td><td>5,281</td></tr><tr><td>21</td><td>1122334455</td><td>5,071</td></tr><tr><td>22</td><td>123321</td><td>4,781</td></tr><tr><td>23</td><td>Aa123123</td><td>4,742</td></tr><tr><td>24</td><td>qwerty</td><td>4,737</td></tr><tr><td>25</td><td>Shein2018</td><td>4,715</td></tr><tr><td>26</td><td>sheinshein</td><td>4,403</td></tr><tr><td>27</td><td>qwert</td><td>3,949</td></tr><tr><td>28</td><td>qwertyuiop</td><td>3,904</td></tr><tr><td>29</td><td>123123123</td><td>3,902</td></tr><tr><td>30</td><td>Aa112233</td><td>3,881</td></tr><tr><td>31</td><td>Aa11223344</td><td>3,785</td></tr><tr><td>32</td><td>1234512345</td><td>3,737</td></tr><tr><td>33</td><td>shein2017</td><td>3,682</td></tr><tr><td>34</td><td>onedirection</td><td>3,542</td></tr><tr><td>35</td><td>password1</td><td>3,473</td></tr><tr><td>36</td><td>iloveyou</td><td>3,295</td></tr><tr><td>37</td><td></td><td>3,294</td></tr><tr><td>38</td><td>qwer1234</td><td>3,156</td></tr><tr><td>39</td><td>12344321</td><td>3,086</td></tr><tr><td>40</td><td>azerty</td><td>2,979</td></tr><tr><td>41</td><td>12345678910</td><td>2,934</td></tr><tr><td>42</td><td>chocolate</td><td>2,920</td></tr><tr><td>43</td><td>motdepasse</td><td>2,885</td></tr><tr><td>44</td><td>abc123</td><td>2,784</td></tr><tr><td>45</td><td>sunshine</td><td>2,754</td></tr><tr><td>46</td><td>princess</td><td>2,745</td></tr><tr><td>47</td><td>asDF1234</td><td>2,662</td></tr><tr><td>48</td><td>asdfghjkl</td><td>2,586</td></tr><tr><td>49</td><td>000000</td><td>2,567</td></tr><tr><td>50</td><td>shein@123</td><td>2,554</td></tr><tr><td>51</td><td>shein.com</td><td>2,547</td></tr><tr><td>52</td><td>loulou</td><td>2,524</td></tr><tr><td>53</td><td>SheIn2016</td><td>2,522</td></tr><tr><td>54</td><td>Mm123456</td><td>2,515</td></tr><tr><td>55</td><td>1234554321</td><td>2,456</td></tr><tr><td>56</td><td>as123456</td><td>2,401</td></tr><tr><td>57</td><td>987654321</td><td>2,399</td></tr><tr><td>58</td><td>qwerty123</td><td>2,389</td></tr><tr><td>59</td><td>shein1234</td><td>2,381</td></tr><tr><td>60</td><td>justinbieber</td><td>2,363</td></tr><tr><td>61</td><td>112233445566</td><td>2,354</td></tr><tr><td>62</td><td>abcd1234</td><td>2,330</td></tr><tr><td>63</td><td>shopping1</td><td>2,329</td></tr><tr><td>64</td><td>chouchou</td><td>2,313</td></tr><tr><td>65</td><td>doudou</td><td>2,289</td></tr><tr><td>66</td><td>654321</td><td>2,276</td></tr><tr><td>67</td><td>passwort</td><td>2,267</td></tr><tr><td>68</td><td>hallo123</td><td>2,254</td></tr><tr><td>69</td><td>chocolat</td><td>2,246</td></tr><tr><td>70</td><td>121212</td><td>2,204</td></tr><tr><td>71</td><td>forever21</td><td>2,176</td></tr><tr><td>72</td><td>hellokitty</td><td>2,165</td></tr><tr><td>73</td><td>Aa12341234</td><td>2,126</td></tr><tr><td>74</td><td>ichliebedich</td><td>2,110</td></tr><tr><td>75</td><td>clothes</td><td>2,092</td></tr><tr><td>76</td><td>ss123456</td><td>2,024</td></tr><tr><td>77</td><td>fashion</td><td>1,934</td></tr><tr><td>78</td><td>incorrect</td><td>1,888</td></tr><tr><td>79</td><td>shopping123</td><td>1,881</td></tr><tr><td>80</td><td>Aa123456789</td><td>1,877</td></tr><tr><td>81</td><td>hello123</td><td>1,849</td></tr><tr><td>82</td><td>12345678900</td><td>1,842</td></tr><tr><td>83</td><td>soleil</td><td>1,778</td></tr><tr><td>84</td><td>12341234</td><td>1,766</td></tr><tr><td>85</td><td>charlotte</td><td>1,756</td></tr><tr><td>86</td><td>compras</td><td>1,735</td></tr><tr><td>87</td><td>michelle</td><td>1,715</td></tr><tr><td>88</td><td>11111111</td><td>1,707</td></tr><tr><td>89</td><td>butterfly</td><td>1,704</td></tr><tr><td>90</td><td>Rr123456</td><td>1,701</td></tr><tr><td>91</td><td>azertyuiop</td><td>1,661</td></tr><tr><td>92</td><td>shein18</td><td>1,651</td></tr><tr><td>93</td><td>sheinpassword</td><td>1,633</td></tr><tr><td>94</td><td>Password123</td><td>1,621</td></tr><tr><td>95</td><td>charlie</td><td>1,620</td></tr><tr><td>96</td><td>Aa1234567</td><td>1,618</td></tr><tr><td>97</td><td>zxcvbnm</td><td>1,600</td></tr><tr><td>98</td><td>20092012</td><td>1,592</td></tr><tr><td>99</td><td>123456aA</td><td>1,590</td></tr><tr><td>100</td><td>welcome1</td><td>1,586</td></tr></tbody></table></figure>
<!-- /wp:table -->

<!-- wp:paragraph -->
<p>It should also be noted that the system contained 3,294 one-character passwords meaning that it is probably safe to assume that SheIn did not implement many security rules to enforce password strength.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Judging by the passwords that the users chose, we can safely assume that the service has been in operation at least since 2015 and since then grown steadily - "shein2015" password has been chosen by <strong>699</strong> users, "shein2016" password has been chosen by <strong>2,522</strong> users, "shein2017" password has been chosen by  <strong>3,682</strong> users and the "shein2018" password has been chosen by <strong>4,715</strong> users.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>This allows us to make an assumption that the choices of year-based passwords grew by <strong>1,823</strong> users in 2016, by <strong>1,160</strong> users in 2017 and by <strong>1,033</strong> users in 2018. Average growth per year - <strong>1338.666666666667</strong> users who chose new year-based passwords, so we can assume that the service would have had approximately <strong>2,372</strong> new users who would have chosen new year-based passwords in 2019 and approximately <strong>3,711</strong> new users who would have chosen new year-based passwords in 2020.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>More interesting password choices include one-character passwords like "&amp;", "S", "43", and "(", the word "sonnenschein" has been used <strong>1,356</strong> times, "papillon" has been used <strong>1,131</strong> times, "1q2w3e4r5t" has been used <strong>1,065</strong> times and "ritinhasantos4" has been used <strong>1,021</strong> times.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>We can also see that there are multiple passwords that have been used the same number of times - there are <strong>73</strong> of them:</p>
<!-- /wp:paragraph -->

<!-- wp:table -->
<figure class="wp-block-table"><table><tbody><tr><th>#</th><th>Password</th><th>Quantity</th><th>Password Repeat Times</th></tr><tr><td>1</td><td>estrella</td><td>1,001</td><td>2</td></tr><tr><td>2</td><td>00000</td><td>1,060</td><td>2</td></tr><tr><td>3</td><td>happy123</td><td>1,062</td><td>2</td></tr><tr><td>4</td><td>;</td><td>1,095</td><td>2</td></tr><tr><td>5</td><td>Iloveshein</td><td>1,131</td><td>2</td></tr><tr><td>6</td><td>Aa1122334455</td><td>1,356</td><td>2</td></tr><tr><td>7</td><td>10203040</td><td>616</td><td>3</td></tr><tr><td>8</td><td>123456788</td><td>619</td><td>2</td></tr><tr><td>9</td><td>jesus123</td><td>625</td><td>2</td></tr><tr><td>10</td><td>999999</td><td>627</td><td>4</td></tr><tr><td>11</td><td>samantha1</td><td>631</td><td>2</td></tr><tr><td>12</td><td>123123AA</td><td>634</td><td>3</td></tr><tr><td>13</td><td>chicken</td><td>635</td><td>2</td></tr><tr><td>14</td><td>2</td><td>639</td><td>2</td></tr><tr><td>15</td><td>Computer</td><td>642</td><td>3</td></tr><tr><td>16</td><td>Aa100100</td><td>648</td><td>3</td></tr><tr><td>17</td><td>alessandro</td><td>649</td><td>3</td></tr><tr><td>18</td><td>Daisy123</td><td>652</td><td>4</td></tr><tr><td>19</td><td>lolipop</td><td>655</td><td>2</td></tr><tr><td>20</td><td>family</td><td>656</td><td>2</td></tr><tr><td>21</td><td>purple123</td><td>657</td><td>2</td></tr><tr><td>22</td><td>love2shop</td><td>666</td><td>3</td></tr><tr><td>23</td><td>ashley</td><td>667</td><td>2</td></tr><tr><td>24</td><td>monkey123</td><td>673</td><td>2</td></tr><tr><td>25</td><td>(</td><td>676</td><td>2</td></tr><tr><td>26</td><td>justine</td><td>679</td><td>3</td></tr><tr><td>27</td><td>11223344556677</td><td>684</td><td>2</td></tr><tr><td>28</td><td>angela</td><td>692</td><td>2</td></tr><tr><td>29</td><td>123456789Aa</td><td>697</td><td>2</td></tr><tr><td>30</td><td>fuckyou</td><td>698</td><td>2</td></tr><tr><td>31</td><td>michelle1</td><td>699</td><td>2</td></tr><tr><td>32</td><td>224466</td><td>702</td><td>2</td></tr><tr><td>33</td><td>1234abcd</td><td>705</td><td>2</td></tr><tr><td>34</td><td>7654321</td><td>712</td><td>2</td></tr><tr><td>35</td><td>Mm11223344</td><td>715</td><td>2</td></tr><tr><td>36</td><td>123098</td><td>717</td><td>4</td></tr><tr><td>37</td><td>aa12345</td><td>718</td><td>3</td></tr><tr><td>38</td><td>131313</td><td>720</td><td>3</td></tr><tr><td>39</td><td>alessia</td><td>721</td><td>2</td></tr><tr><td>40</td><td>elizabeth1</td><td>724</td><td>2</td></tr><tr><td>41</td><td>beatrice</td><td>725</td><td>2</td></tr><tr><td>42</td><td>cooper</td><td>730</td><td>2</td></tr><tr><td>43</td><td>a1234567</td><td>731</td><td>2</td></tr><tr><td>44</td><td>buddy123</td><td>733</td><td>3</td></tr><tr><td>45</td><td>amandine</td><td>738</td><td>4</td></tr><tr><td>46</td><td>motherlode</td><td>739</td><td>2</td></tr><tr><td>47</td><td>090909</td><td>740</td><td>3</td></tr><tr><td>48</td><td>fatima</td><td>746</td><td>2</td></tr><tr><td>49</td><td>banana</td><td>751</td><td>2</td></tr><tr><td>50</td><td>hannah123</td><td>754</td><td>2</td></tr><tr><td>51</td><td>lovelove</td><td>757</td><td>2</td></tr><tr><td>52</td><td>barbie</td><td>759</td><td>2</td></tr><tr><td>53</td><td>88888888</td><td>773</td><td>2</td></tr><tr><td>54</td><td>asd123</td><td>779</td><td>3</td></tr><tr><td>55</td><td>asdfgh</td><td>783</td><td>2</td></tr><tr><td>56</td><td>112233445566778899</td><td>796</td><td>3</td></tr><tr><td>57</td><td>12121212</td><td>800</td><td>2</td></tr><tr><td>58</td><td>pepper</td><td>811</td><td>2</td></tr><tr><td>59</td><td>00000000</td><td>823</td><td>2</td></tr><tr><td>60</td><td>009988</td><td>824</td><td>3</td></tr><tr><td>61</td><td>aB123456</td><td>842</td><td>2</td></tr><tr><td>62</td><td>123456a</td><td>847</td><td>2</td></tr><tr><td>63</td><td>87654321</td><td>853</td><td>2</td></tr><tr><td>64</td><td>cocacola</td><td>860</td><td>2</td></tr><tr><td>65</td><td>coucou</td><td>874</td><td>2</td></tr><tr><td>66</td><td>123654</td><td>884</td><td>4</td></tr><tr><td>67</td><td>1</td><td>885</td><td>2</td></tr><tr><td>68</td><td>lalala</td><td>897</td><td>2</td></tr><tr><td>69</td><td>d</td><td>925</td><td>2</td></tr><tr><td>70</td><td>123455</td><td>952</td><td>2</td></tr><tr><td>71</td><td>Asd12345</td><td>964</td><td>2</td></tr><tr><td>72</td><td>marina</td><td>981</td><td>2</td></tr><tr><td>73</td><td>patricia</td><td>998</td><td>2</td></tr></tbody></table></figure>
<!-- /wp:table -->

<!-- wp:paragraph -->
<p>Best guess would be that these passwords were created by users who had more than one account in the system and thus, the times passwords repeated would match the count of multiple accounts the user had.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Apart from this, there are also a lot of passwords that begin with alphabetical letters and numbers. Here is the list of passwords that begin with letters:</p>
<!-- /wp:paragraph -->

<!-- wp:table -->
<figure class="wp-block-table"><table><tbody><tr><th>#</th><th>The letter the password begins with</th><th>Quantity</th></tr><tr><td>1</td><td>A</td><td>1,992,010</td></tr><tr><td>2</td><td>B</td><td>1,298,884</td></tr><tr><td>3</td><td>C</td><td>1,455,374</td></tr><tr><td>4</td><td>D</td><td>964,988</td></tr><tr><td>5</td><td>E</td><td>710,719</td></tr><tr><td>6</td><td>F</td><td>803,599</td></tr><tr><td>7</td><td>G</td><td>789,006</td></tr><tr><td>8</td><td>H</td><td>887,892</td></tr><tr><td>9</td><td>I</td><td>660,077</td></tr><tr><td>10</td><td>J</td><td>978,300</td></tr><tr><td>11</td><td>K</td><td>906,390</td></tr><tr><td>12</td><td>L</td><td>1,342,680</td></tr><tr><td>13</td><td>M</td><td>2,109,455</td></tr><tr><td>14</td><td>N</td><td>904,379</td></tr><tr><td>15</td><td>O</td><td>458,681</td></tr><tr><td>16</td><td>P</td><td>1,213,355</td></tr><tr><td>17</td><td>Q</td><td>349,112</td></tr><tr><td>18</td><td>R</td><td>940,811</td></tr><tr><td>19</td><td>S</td><td>2,286,583</td></tr><tr><td>20</td><td>T</td><td>955,001</td></tr><tr><td>21</td><td>U</td><td>289,858</td></tr><tr><td>22</td><td>V</td><td>536,327</td></tr><tr><td>23</td><td>W</td><td>492,077</td></tr><tr><td>24</td><td>X</td><td>255,748</td></tr><tr><td>25</td><td>Y</td><td>381,001</td></tr><tr><td>26</td><td>Z</td><td>391,859</td></tr></tbody></table></figure>
<!-- /wp:table -->

<!-- wp:paragraph -->
<p>Here is the list of passwords that begin with numbers:</p>
<!-- /wp:paragraph -->

<!-- wp:table -->
<figure class="wp-block-table"><table><tbody><tr><th>The number the password begins with</th><th>Quantity</th></tr><tr><td>0</td><td>656,343</td></tr><tr><td>1</td><td>1,423,879</td></tr><tr><td>2</td><td>613,947</td></tr><tr><td>3</td><td>299,329</td></tr><tr><td>4</td><td>236,096</td></tr><tr><td>5</td><td>231,729</td></tr><tr><td>6</td><td>232,289</td></tr><tr><td>7</td><td>235,043</td></tr><tr><td>8</td><td>247,879</td></tr><tr><td>9</td><td>341,314</td></tr></tbody></table></figure>
<!-- /wp:table -->

<!-- wp:paragraph -->
<p>In the data dump there are <strong>408,406</strong> passwords that are less than or equal to 5 characters in length, <strong>20,919,888</strong> passwords that are less than or equal to 10 characters in length, <strong>29,187,461</strong> passwords that are less than or equal to 20 characters in length, <strong>65,519</strong> passwords that are more than or equal to 20 characters in length, <strong>40,642</strong> passwords that are more than or equal to 30 characters in length. There are even passwords that are more than or equal to 40 characters in length - the total count of such passwords is <strong>48</strong>. It is very likely that the passwords that are more than or equal to 20 characters in length were generated by password managers.</p>
<!-- /wp:paragraph -->

<!-- wp:heading -->
<h2>Summary</h2>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>To summarize, the SheIn data breach, although relatively small compared to the bigger ones, did bring a lot of damage to the company and to its customers. The good thing is that SheIn notified all of their customers that their data is at risk - they also collaborated with cybersecurity investigators who monitored the network and tried to ensure that future data breaches can be prevented.</p>
<!-- /wp:paragraph -->