The punishment follows an investigation by the Attorney General’s Office into a 2018 attack in which credit card and personal information, such as names, emails, and hashed passwords, were obtained. The data hack compromised 39 million Shein and 7 million Romwe accounts, including over 800,000 New Yorker accounts.
