H&M Data Leak Claims Trail Leads to Warehouse Supplier GreyOrange

H&M is investigating breach allegations after threat actors claimed to possess company data and gave the Swedish retailer three days to make contact before leaking it. H&M previously stated it sees no signs of a compromise.

ShinyHunters connection questioned

Media reports attributed the incident to ShinyHunters, a hacking group known for data extortion campaigns. However, Cybernews researchers found no evidence supporting that claim. According to cybersecurity tracking tool Vercert, the H&M dataset appeared on underground forums last week under the name ShinyHunters, but the account behind the post was marked as retired.

ShinyHunters typically announces breaches on its own onion site, which is currently offline. The group's data server remains online but contains nothing related to H&M. Ransomware.live records show ShinyHunters was active until the end of September, well before the alleged listing appeared. Researchers also noted the dataset is circulating on multiple Telegram channels, which they say makes a false flag claim by unrelated hackers more likely.

Evidence points to warehouse software

A new message appeared on the attackers' communication channel claiming the incident may actually be a third-party breach. The threat actors, who said they are definitely not ShinyHunters, published a small file containing JSON records of product information. Cybernews analysis found the samples were linked to GreyOrange, a warehouse management software platform that lists H&M and Walmart Canada among its clients.

The records included product image URLs and various identifiers that could be attributed to H&M. However, researchers cautioned that this does not necessarily mean the attackers hold more sensitive material such as personal employee data, as that depends on how the system is built and how GreyOrange integrates with it.

Cybernews reached out to both GreyOrange and H&M for comment and will update the article when responses are received.

Sources: Cybernews