H&M is investigating allegations that ShinyHunters accessed internal databases containing logistics, inventory and sales information. However, the H&M breach claims remain unverified, and the retailer says it has found no indication that attackers compromised its data environment.
The fashion group acknowledged online allegations involving a potentially limited portion of its data. It is now assessing whether those claims are valid.
Hackers Claim Access to Retail Operations Data
ShinyHunters alleges that it obtained records covering inventory management, logistics, sales analytics and store infrastructure.
According to the group’s claims, the information includes details about systems supporting store operations and order fulfillment. Such records could reveal how the retailer tracks stock and moves goods through its supply chain.
However, the available information does not establish that the group accessed these databases or stole the alleged records. H&M has also not confirmed the specific categories or volume of potentially affected data.
H&M Breach Claims Remain Under Investigation
H&M’s response distinguishes between acknowledging the allegations and confirming an intrusion.
The company said it was aware of claims concerning a potential cybersecurity incident involving limited group data. Meanwhile, its investigation has so far found no sign of a compromised data environment.
The retailer has not provided further technical details or identified a possible entry point. Consequently, the extent of any exposure remains unclear.
H&M operates approximately 4,000 stores across more than 80 markets. Its wider portfolio includes COS, Weekday, & Other Stories and Arket.
ShinyHunters Uses Employee Impersonation Tactics
ShinyHunters has a history of social engineering attacks that target employees rather than relying solely on software vulnerabilities.
One recurring approach involves impersonating IT support staff to obtain employee credentials. These campaigns have targeted Okta access, which organizations use to manage authentication across business applications.
However, there is no confirmed evidence that this technique played a role in the alleged H&M incident.
In recent months, the group has claimed responsibility for attacks involving businesses such as Hims & Hers, ReliaQuest, CyrusOne, Sysco and Ralph Lauren. Those separate claims do not establish the validity of its latest allegations.
Investigation Follows a Separate ASOS Incident
The H&M allegations come shortly after ASOS confirmed that an unauthorized party accessed personal data.
Customers of the online fashion retailer received a phone notification warning of a hack. That message also alleged a compromise involving data storage company Snowflake, although the notification itself did not verify that claim.
ASOS said the incident did not expose payment card information or account passwords.
For H&M, the central question remains whether any unauthorized access occurred. Until its investigation establishes otherwise, the alleged database theft remains an attacker claim rather than a confirmed breach.
0 responses to “H&M Breach Claims Spark Investigation Into Alleged Data Theft”