H&M Group is investigating claims that cybercriminals targeted the company, making the Swedish retailer the latest fashion business to face a security scare this autumn. The group said it was looking into reports of a potential incident involving a limited amount of company data, but that it had so far found no evidence its systems had been compromised.
The reports connect the alleged attack to ShinyHunters, which Retail Gazette describes as a financially motivated cybercriminal group. The group is known for using social engineering, phishing and weaknesses in cloud services to get hold of corporate data. H&M has not confirmed that ShinyHunters was involved, and it has not said what kind of information the claims concern. Social engineering relies on tricking staff into handing over access, so such attacks often start with people rather than with technical flaws. Besides its main H&M brand, the Swedish group also owns Cos, Arket and Monki.
An H&M spokesperson told The Times that the investigation was still under way and that the company could not share further details at this stage. “Protecting the security of our systems and data is of utmost importance to us,” the spokesperson said. The statement stopped short of ruling anything out, but the company was clear that its checks had not yet turned up signs of a breach. Retail Gazette said the case adds to fresh concern over the security risks facing fashion retailers.
The claims surfaced less than a week after ASOS customers received threatening notifications on 6 October. ASOS later explained that an unauthorised party had gained access to an employee account by posing as a trusted contact and obtaining login credentials. Those details were then used to reach information held on some of the third-party platforms the online retailer uses. ASOS said the affected platforms were locked down immediately and that it was working with law enforcement and regulators on the case.
ASOS has since confirmed its earlier position that payment card details and account passwords were not affected. Its own investigation found that the intruder did access some personal information, including names and contact details, along with certain non-personal account data. The result of H&M’s internal review should show whether any company data was taken and whether further steps are needed. The company gave no timetable for when it expects to share an update on its findings.
