- H&M Group is investigating claims of a potential cyberattack involving ShinyHunters but says it has found no evidence that its data systems have been compromised.
- The investigation follows an October 6 breach at ASOS, where attackers obtained employee credentials and accessed customer information through third-party platforms.
- H&M shares fell approximately 1.3% on October 12 as the allegations raised questions about retail cybersecurity, third-party vulnerabilities and potential cyber insurance exposure.
Swedish fashion retailer H&M Group is investigating claims of a potential cybersecurity incident linked to the ShinyHunters hacking group, following a confirmed cyberattack on British online fashion retailer ASOS.
The allegations, first reported by The Times, concern a possible compromise of H&M’s systems or data. The company, which owns H&M, Cos, Arket and Monki, said it was examining information circulating online but had found no evidence of unauthorized access.
We are aware of information circulating online regarding a potential cyber security incident and are currently investigating the claims. At this time, we have not found any indications that our data environment has been compromised
H&M said in a statement
The retailer confirmed that it had not notified the UK’s Information Commissioner’s Office (ICO), explaining that its investigation had not identified evidence of a data breach.
Under UK data protection rules, organizations generally must report personal data breaches to the ICO within 72 hours of becoming aware of them unless the incident is unlikely to create risks to individuals’ rights and freedoms.
The investigation follows a confirmed cyber security incident at ASOS on October 6, when customers received an unauthorized push notification through the company’s mobile application.
The message, attributed to a group calling itself Xuanye, claimed that attackers had compromised ASOS’s Snowflake cloud data environment and threatened to publish information.
ASOS subsequently confirmed that an attacker impersonated a trusted contact to obtain an employee’s login credentials. Those credentials were used to access third-party platforms containing customer names, contact details and certain account-related information.
The retailer said payment card information and account passwords were not accessed. Its website and mobile application remained operational throughout the incident.
The attackers’ broader claims concerning Snowflake have not been independently established, nor has a connection between the groups associated with the ASOS and H&M incidents been confirmed.
ShinyHunters has previously been associated with financially motivated cyberattacks involving social engineering, phishing and attempts to obtain corporate data.
Separate reports have linked the group claiming responsibility for the ASOS attack to an incident involving Air France-KLM. The airline group confirmed unauthorized access to internal folders but said no sensitive data was exposed and customer services were unaffected.
The incidents demonstrate how compromised employee credentials and external technology providers can create cybersecurity exposures without necessarily disrupting a company’s main operating systems.
For cyber insurers, unauthorized access to customer information may generate costs associated with forensic investigations, legal advice, breach notification and regulatory proceedings.
More extensive attacks that interrupt retail operations could also produce business interruption claims, depending on policy terms and the circumstances of the incident.
ASOS previously confirmed that it maintains cyber insurance, including business continuity protection, although it said the financial consequences of its breach were too early to quantify.
H&M has not confirmed a cybersecurity breach, customer data exposure or operational disruption. Its investigation remains focused on determining whether the online allegations have any factual basis.
