H&M is investigating claims that it was targeted by the cybercriminal group suspected of carrying out a recent attack on British online fashion retailer ASOS, raising fresh concerns about the security of customer data at major fashion brands.
The Swedish clothing giant, which also owns Cos, Arket and Monki, said it was examining reports of a potential cybersecurity incident involving a limited amount of company data. However, H&M stressed that it had found no indication so far that its data environment had been compromised.
The investigation follows a cyber incident at ASOS in which hackers allegedly gained access to an employee's account through social engineering before accessing information held on third-party platforms used by the retailer.
The potential H&M incident has not been confirmed as a successful breach, and it remains unclear whether customer information was accessed.
H&M Investigates Claims of Cyberattack
H&M said it was aware of claims circulating online about a possible cybersecurity incident and was working to establish whether they were valid.
'We are aware of the claims circulating online regarding a potential cybersecurity incident involving a limited scope of H&M Group data,' a company spokeswoman told The Times. 'Protecting the security of our systems and data is of utmost importance to us.'
The spokeswoman added that the company had not found evidence that its data environment had been compromised and was unable to provide further details while the investigation continued. The Information Commissioner's Office (ICO), the UK's data protection regulator, had not received a report about the alleged H&M incident as of Monday lunchtime, according to the report.
It was also unclear whether the National Cyber Security Centre (NCSC), which is part of GCHQ, had been contacted.
How the ASOS Hack Unfolded
The H&M investigation comes after ASOS confirmed that an unauthorised party gained access to an employee account by impersonating a trusted contact to obtain login credentials.
The stolen credentials were then used to access information on certain third-party platforms used by the online retailer, according to ASOS's security notification. The company said it had restricted access to the affected platforms and launched an investigation with external experts, law enforcement and regulatory authorities.
The incident became public on 6 October, when some ASOS customers received an unauthorised push notification through the retailer's app. The message claimed customer data had been stolen and urged the company to engage with the attackers.
ASOS subsequently confirmed that some basic personal information and contact details may have been accessed. The company said it did not believe account passwords or payment card details had been compromised.
The attack highlights how cybercriminals can exploit employees and trusted relationships to gain access to corporate systems, rather than relying solely on technical vulnerabilities.
Who Are the Hackers Linked to the Incidents?
The group associated with the ASOS incident has used the name Xuanye Group, which has been translated as 'Mysterious Splendour'. The Times reported that sources believed H&M may have been targeted by the same group.
The alleged connection does not establish that the same attackers successfully accessed H&M's systems. The Swedish retailer is still assessing the claims, and no confirmed H&M data compromise has been announced.
The Times also identified ShinyHunters as a group associated with the claims under investigation at H&M. The financially motivated cybercriminal group has been linked to attacks involving social engineering, voice phishing and cloud services.
The names and attribution should be treated cautiously while investigations continue. Public claims made by cybercriminals do not, by themselves, prove that a company has suffered a breach or establish who was responsible.
What Should H&M Customers Know?
For H&M customers, there is currently no confirmed evidence in the company's statement that its data environment has been compromised. The investigation is ongoing, and the retailer has not disclosed whether any customer information was accessed.
Customers should remain alert to suspicious communications but should not assume their information has been stolen solely because H&M is investigating the claims.
The incidents add to wider concerns about cyberattacks affecting major businesses and the third-party platforms on which they rely.
Retailers hold large volumes of customer information and depend on interconnected systems for online shopping, account management and business operations. A compromised employee account or supplier platform can create risks that extend beyond a company's own systems.
