H&M Probes Potential Cyberattack Claims by ShinyHunters Amid Retail Sector Security Concerns

The hacking collective ShinyHunters targets major corporations. The group links to a cyberattack on Jaguar Land Rover and a 2024 incident involving Ticketmaster. In the Ticketmaster case, they reportedly demanded a £400,000 ransom. ShinyHunters uses social engineering and phishing to obtain corporate login credentials.

On October 6, 2026, the online retailer Asos suffered a cyberattack. Attackers impersonated a trusted contact to secure an employee's login credentials. Asos confirmed that no payment card information or account passwords were accessed during this breach, which has been linked to a group also associated with an incident at Air France-KLM. They gained access to customer names and contact details. H&M Group operates 4,000 stores across more than 80 markets. The company is now investigating similar claims involving ShinyHunters. H&M shares fell 1.5% on October 12, 2026. The company stated it has not notified the UK’s Information Commissioner’s Office. Its internal review found no evidence of a data breach.

1. H&M Group launched an investigation into the claims and found no evidence that its data environment was compromised.

2. Because the internal investigation found no evidence of a breach, H&M Group did not notify the UK’s Information Commissioner’s Office.

3. The company operates 4,000 stores in more than 80 markets. No service disruptions have been reported.

4. H&M Group's brand portfolio, which includes H&M, Cos, Arket, Weekday, & Other Stories, and Monki, remains operational as the investigation proceeds.

1. H&M shares fell 1.5% on October 12, 2026. Investors showed sensitivity to data security threats in the retail sector.

2. The attack on Asos on October 6, 2026, resulted in unauthorized access to customer names and contact details. Attackers stole credentials by impersonating a trusted contact.

3. ShinyHunters is linked to the H&M claims. The group uses social engineering and phishing to bypass corporate security. They previously targeted Air France-KLM and Ticketmaster.

4. Attackers breached corporate systems during the Asos incident by exploiting individual employee credentials. This occurred even when platform providers like Snowflake were not at fault.