H&M Investigates Claims of Cybersecurity Incident

The Swedish fashion giant H&M is reportedly investigating claims that it has been targeted by a cybersecurity incident. The Times reported on Monday that the company is looking into potential threats made by a hacking group named Shinyhunters.

H&M's Response to the Claims

A spokeswoman for H&M Group told The Times that the company was aware of circulating online claims regarding a potential cybersecurity incident affecting a limited scope of H&M Group data. "Protecting the security of our systems and data is of utmost importance to us," she stated. The company is currently investigating these claims to assess their validity. "So far we have no indication that our data environment has been compromised," the spokeswoman added. She also noted that the company takes any potential threat to its systems and data seriously and, as the work is ongoing, further details could not be provided at this time.

Previous Activities of Shinyhunters

The hacking gang Shinyhunters has previously claimed responsibility for attacks on other entities. These include a significant cyber attack on Jaguar Land Rover last summer, alongside other hacking groups. Shinyhunters has also reportedly demanded a ransom payment of around £400,000 to prevent data being sold after an attack on Ticketmaster in 2024.

Regulatory Oversight and Market Context

As of Monday lunchtime, the UK’s independent data watchdog, the Information Commissioner’s Office (ICO), had not received a report on the incident. Organisations are required to report personal data breaches to the ICO within 72 hours of becoming aware of them, provided they pose a risk to people’s rights and freedoms. It remains unclear if the National Cyber Security Centre (NCSC) has been contacted, though companies are not legally obligated to notify the NCSC directly about cybersecurity incidents.

H&M shares saw a 1.5% decrease on Monday. The company recently reported that net sales increased to 57.2 billion Swedish krona (£4.4 billion) between June and September, a 1% rise compared to the previous year. This marked a return to growth after sales declined by 3% in the first half of the financial year.

This reported incident follows a recent data breach at fast fashion business Asos. Last week, Asos stated that an unauthorised party had gained access to some personal data, including names and contact details. Asos customers received alerts, with the retailer stressing that no payment card information or account passwords were accessed. Snowflake, a data storage firm, later stated the breach was not caused by a vulnerability in its platform.