H&M Investigates ShinyHunters Data Breach Claims

H&M reviews unverified ShinyHunters claims

ShinyHunters claims it accessed H&M databases containing inventory records, logistics data, sales analytics, and details about infrastructure used to manage stores and fulfill orders. H&M said it has found no indication so far that its data environment was compromised.

The retailer said it was examining claims of a potential cybersecurity incident linked to ShinyHunters and trying to determine whether they are valid. It described the matter as involving a limited scope of H&M Group data and gave no further details.

Retailer context

H&M operates about 4,000 stores across more than 80 markets. Its portfolio includes COS, Weekday, & Other Stories, and Arket. The claims follow a separate reported incident at ASOS, which said an unauthorized party accessed personal data and that payment card information and account passwords were not accessed. ASOS also referenced compromised data storage company Snowflake in customer alerts.

ShinyHunters pattern

ShinyHunters is known for social engineering attacks in which it impersonates IT support staff and phishes for employee access credentials, including Okta access. In recent months the group claimed attacks on Hims & Hers, ReliaQuest, CyrusOne, Sysco, and Ralph Lauren, and it previously claimed intrusions at Dutch telecom provider Odido and the European Commission.

The group has also claimed to have stolen sensitive FBI data covering almost all agents, employees, and job applicants through the FBI jobs web portal. Dutch authorities arrested a 24 year old Amsterdam man on September 15 over suspected involvement, while ShinyHunters rejected claims that he was part of its operation. At the beginning of October, another suspected member was detained in Jordan and reportedly helped the FBI track other suspects. After the Dutch arrest, the group resumed activity with a mass exploitation campaign targeting Oracle PeopleSoft human resources management systems.

Sources: Cybernews