What: H&M Group is investigating claims that it was hit by a cyberattack by the Shinyhunters group, which sources told The Times is also behind last week's attack on Asos.

Why it is important: Shinyhunters' reliance on social engineering, AI-powered voice phishing and cloud misconfigurations puts the weak points in staff and cloud set-up, the same third-party and omnichannel exposure that hit De Bijenkorf and M&S.

H&M Group, which also owns Cos, Arket and Monki, is investigating claims that it was subject to a cyberattack last week. The group said it was looking into a potential incident carried out by Shinyhunters, a financially motivated cybercriminal group that specialises in social engineering, AI-powered voice phishing and exploiting cloud service misconfigurations, The Times reported.

Sources told The Times they thought H&M had been targeted by the same group behind last week's attack on Asos, which is thought to be from a Telegram channel called the Xuanye Gateway.

An H&M Group spokesperson said the company was aware of claims circulating online about a potential incident involving a limited scope of its data. It is investigating to assess their validity and so far has no indication that its data environment has been compromised.

Asos confirmed that thousands of its customers' details are now in hackers' possession following its cyber attack on Tuesday 6 October. Asos told customers the unauthorised party accessed some personal information, including names and contact details, but no payment card information or account passwords. A push notification sent to some customers claimed the Snowflake instance had been fully compromised.

IADS Notes: The Asos incident surfaced through app notifications in which the attackers claimed to have compromised the retailer's Snowflake instance and threatened to leak data, following attacks on Jaguar Land Rover and the Co-op Group (Financial Times, October 2026). Analysis of why the sector is so exposed points to the combination of rich customer data and interconnected omnichannel and third-party systems, which attackers exploit through weaker providers (Retail Insight Network, July 2026). The vendor route was visible at De Bijenkorf, where a cyberattack on logistics partner CEVA exposed customer names, contact details and payment-method descriptions and prompted a phishing warning to shoppers (nu.nl, September 2026), and at M&S, where an incident traced to human error at a third-party supplier forced a seven-week suspension of online sales and a £136mn profit hit (Financial Times, November 2025). The leadership cost of a prolonged crisis appeared at Co-op, whose chief executive is stepping down as attack-related costs mount (Financial Times, March 2026).

H&M investigates cyberattack claims