H&M investigates potential cyber-attack

H&M is investigating claims relating to a potential cyber-security incident made by a group called Shinyhunters, as first reported today (12 October) by The Times .

Sources told the newspaper that they thought H&M had also been targeted by the same group behind an attack last week at digital fashion giant Asos . The hackers claimed to be called the Xuanye group, a name translating to “Mysterious Splendour”.

The Swedish clothing company, which owns H&M , Cos , Arket and Monki, said in a statement this afternoon (12 October): “We are aware of information circulating online regarding a potential cyber security incident and are currently investigating the claims.

“At this time, we have not found any indications that our data environment has been compromised.”

H&M shares were trading down by 1.3% on the Stockholm exchange today.

H&M confirmed that it had not contacted the Information Commissioner’s Office (ICO), the UK’s independent data watchdog, as it had not found any indications that its data environment had been compromised.

Companies must notify the ICO within 72 hours of becoming aware of a personal data breach, unless it does not pose a risk to people’s rights and freedoms.

The National Cyber Security Centre, the UK government’s lead organisation for cyber-security, encourages organisations to report significant incidents.

The NCSC’s reporting service says a report should be made if an incident affects data on employees, customers or clients, the organisation’s computer systems or personal data relating to people in the UK, Channel Islands or Isle of Man.

This comes after Asos app users received notifications indicating the fashion retailer’s data had been “fully compromised” just before 10am on Tuesday last week (6 October).

In a statement issued to customers on 8 October, Asos said it had since discovered the hackers gained access to an Asos employee’s account by “impersonating a trusted ” to gain log in credentials, resulting in access to information on third-party platforms used by the business.

Asos said the platforms impacted were “immediately locked down” and a full investigation was subsequently launched.

Third-party brands stocked at Asos told Drapers sales had been “slow” the following day (7 October), despite the Asos website and app continuing to operate as normal.