TL;DR
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
H&M Group is investigating claims by the cybercriminal group ShinyHunters that it targeted the fashion company. H&M says it has so far found no indication that its data environment was compromised; the claims have not been independently confirmed.
H&M Group is investigating online claims that it was targeted in a potential cyber incident by the group ShinyHunters, but the Swedish fashion company said it has no indication so far that its data environment was compromised. The inquiry concerns claims of an incident involving a limited scope of group data, and H&M has not confirmed that attackers accessed or took information.
An H&M Group spokesperson said the company was aware of claims circulating online and was checking whether they were valid. The spokesperson described the alleged incident as involving a “limited scope” of H&M Group data, while stressing that the company had not found evidence of a compromise in its data environment so far.
“We are currently investigating these claims to assess their validity and so far we have no indication that our data environment has been compromised,” the spokesperson said. The company added that it could not provide further details while the work was ongoing. It has not identified what data may have been involved, when an alleged intrusion might have taken place, or whether any systems were accessed.
The report, published by This Is Money on October 12, said the claims followed a cyberattack on online retailer Asos the previous week. It did not establish that the incidents were connected. H&M Group operates about 4,000 stores in more than 80 markets, with brands including H&M, Cos, Weekday, & Other Stories and Arket, making the status of any potential incident relevant across a large international retail business.
Why H&M’s Data Inquiry Matters
The immediate significance is that H&M has opened an investigation but has not confirmed a breach. That distinction matters: online claims by a criminal group do not by themselves establish that the group entered company systems, obtained data or can publish it. H&M’s statement indicates that its review has not, at the time reported, found evidence that its data environment was compromised.
For customers, employees and business partners, the investigation leaves practical questions about whether any personal or commercial information was exposed. H&M has not said that information was accessed, nor has it described any notification or protective steps for people who might be affected. The company’s scale means a confirmed incident could have consequences across several brands and markets, but the available information does not establish that such an impact has occurred.
The case also shows why attribution and verification are important in cybercrime reporting. A group’s public claim may prompt a company investigation, yet the underlying allegation still needs corroboration. At this stage, the confirmed development is H&M’s response and ongoing inquiry—not a verified attack or data theft.
Products Worth Considering
Canon imagePROGRAF PRO-1100 17-Inch Professional Wireless Inkjet Photo Printer
Apple iMac Pro (27-inch Retina 5K Display, 3.2GHz 8-core Intel Xeon W, 32GB RAM, 1TB SSD) – Space Gray
Dell XPS 13 9350 Copilot+ Laptop, 13.4-inch 120Hz Display, Intel Core Ultra 7 256V, 16GB RAM, 512GB SSD, Ubuntu Linux 24.04 LTS
As an affiliate, we earn on qualifying purchases.
ShinyHunters’ Earlier Claims
ShinyHunters has previously claimed responsibility for high-profile cyber incidents. According to the source report, the group said it was behind a major cyberattack on Jaguar Land Rover the previous summer, alongside groups known as Scattered Spider and Lapsus. That account is background to H&M’s decision to investigate; it does not verify the current claim against H&M or establish that the same people carried out both alleged incidents.
The report also said ShinyHunters reportedly demanded about £400,000 in 2024 to prevent data from being sold after an attack on Ticketmaster. The reported demand and attribution are presented as claims in the source material, rather than proof of the H&M allegation. The source further noted a cyberattack on Asos the week before its H&M report, but supplied no evidence that Asos and H&M were targeted by the same actors or as part of a linked operation.
H&M’s response is therefore limited to the current claim: it is checking whether an incident involving a limited scope of group data occurred. Its statement does not confirm that data was taken, that a ransom was sought, or that the alleged activity affected stores, customer services or other operations.
What the Investigation Has Not Established
H&M has not confirmed that a cyberattack succeeded, and the source report does not provide independent evidence that ShinyHunters accessed its systems. It remains unclear whether the group’s claim is accurate, what systems or records may have been targeted, and whether any information was accessed, copied or offered for sale.
The company has not disclosed when the alleged activity occurred, how it became aware of the claims, or whether its investigation has found signs of attempted access. It has also not said whether customers, staff, regulators or law enforcement have been notified. Those details may depend on what the company learns during its review.
There is no confirmed link in the available material between the H&M allegation and the reported Asos incident, or between this claim and earlier incidents attributed to ShinyHunters. The scope and outcome of the inquiry remain open.
H&M’s Inquiry and Possible Updates
H&M says it is continuing to assess the validity of the claims. The next key development would be a company update establishing whether it found evidence of unauthorized access and, if so, what information or systems were affected. No timeline for completing the investigation was provided in the source report.
If H&M confirms that personal data was exposed, further details could clarify who may be affected and what response measures are planned. Until the company provides that information or evidence independently verifies the claim, the incident should be treated as an allegation under investigation—not as a confirmed breach.
Key Questions
Has H&M confirmed it was hacked?
No. H&M said it was investigating the claims and had no indication so far that its data environment was compromised.
Who says H&M was targeted?
The claim was attributed in the report to ShinyHunters. H&M is checking whether the claim is valid; the available information does not independently confirm it.
Was H&M customer data stolen?
That has not been established. H&M referred to claims involving a limited scope of group data but did not confirm that any data was accessed or taken.
Is the H&M claim connected to the Asos cyberattack?
The report said the H&M claims followed a cyberattack on Asos the previous week, but it provided no evidence that the incidents were linked.
What happens next?
H&M says its investigation is ongoing. The company has not announced a completion date or provided further details about the alleged incident.
Source: rss
