H&M Group is investigating claims that it has been targeted by cybercriminals, raising fresh concerns over security risks facing fashion retailers.
The Swedish fashion giant, which owns H&M, Cos, Arket and Monki, said it was examining reports of a potential cybersecurity incident involving a limited amount of company data.
However, the retailer stressed that it had so far found no evidence that its systems had been compromised.
“We are aware of the claims circulating online regarding a potential cybersecurity incident involving a limited scope of H&M Group data. Protecting the security of our systems and data is of utmost importance to us,” an H&M spokesperson told The Times.
The spokesperson added that the investigation was ongoing and the business was unable to provide further details.
The reports have linked the potential incident to ShinyHunters, a financially motivated cybercriminal group known for using social engineering, phishing and exploiting vulnerabilities in cloud services to access corporate data.
On 06 October, ASOS customers received threatening notifications. The digital fashion platform then revealed that an unauthorised party gained access to an ASOS employee account.
In a message to its customers, ASOS explained: “We discovered that an unauthorised party gained access to an ASOS employee account by impersonating a trusted contact to obtain log in credentials. Those credentials were then used to access information on certain third-party platforms used by ASOS.
“The affected platforms were immediately locked down, ensuring that no further information could be accessed and a full investigation was launched with the support of both internal and external cyber experts. We are also working with the relevant law enforcement and regulatory authorities.”
ASOS had previously stressed that it did not believe that payment-card information or account passwords were impacted. They have now confirmed that.
The statement added: “Our investigation found that the unauthorised party had access to some personal information, including names and contact details, and certain non-personal account related information.”
