H&M probes claims of cyberattack by Shinyhunters group

The Swedish retailer is assessing the validity of allegations linking the Shinyhunters collective to a recent security incident.

By Felo News Desk · Published Mon, 12 Oct 2026 20:26:25 GMT

H&M Group said it is investigating online claims that the Shinyhunters hacking collective targeted its data last week, according to reports in The Times cited by several UK outlets.

What happened

The alleged incident was reported to have occurred in the week preceding 12 October 2026. H&M said the claims refer to a “limited scope” of its data and that, as of the statements given, the company has no indication that its systems have been compromised.

What the reports add

Both Independent.co.uk and the Standard note that Shinyhunters previously claimed responsibility for a major cyber‑attack on Jaguar Land Rover last summer, alongside groups known as Scattered Spider and Lapsus.
The outlets report that the gang demanded roughly £400,000 in ransom after a 2024 attack on Ticketmaster.
The Information Commissioner’s Office (ICO) had not received a breach report as of Monday lunchtime, and it is unclear whether the National Cyber Security Centre (NCSC) has been contacted.
H&M operates about 4,000 stores in more than 80 markets and includes brands such as Cos, Weekday, & Other Stories and Arket.
H&M shares fell 1.5 % on Monday following the news.
Last month the retailer said net sales had increased by £4.4 billion.

What was said

“We are aware of the claims circulating online regarding a potential cybersecurity incident involving a limited scope of H&M Group data. Protecting the security of our systems and data is of utmost importance to us,” a H&M Group spokeswoman told The Times, as quoted by Independent.co.uk.

“We are currently investigating these claims to assess their validity and so far we have no indication that our data environment has been compromised. We take any potential threat to our systems and data seriously and, as this work is ongoing, we are unable to provide further details at this time,” the spokeswoman added, per the Standard.

How it came about

H&M’s investigation follows a series of high‑profile cyber incidents targeting retail and automotive firms, including the recent ASOS data‑breach probe reported by Felo News on 6 October 2026. The retailer’s extensive brand portfolio – Cos, Weekday, & Other Stories, Arket and others – makes it a frequent target for cyber‑crime groups seeking valuable consumer data.

Key facts

H&M is investigating claims that the Shinyhunters group targeted its data last week. (independent.co.uk)
The company says there is no indication its data environment has been compromised. (standard.co.uk)
Shinyhunters previously claimed responsibility for a Jaguar Land Rover attack and a 2024 Ticketmaster ransomware demand of about £400,000. (independent.co.uk)