The extortion group ShinyHunters claims it accessed internal H&M databases, while the Swedish retailer says it has found no indication so far that its data environment was compromised. The claim is unverified.
ShinyHunters Says It Holds Inventory and Logistics Data
ShinyHunters claims access to H&M’s internal databases containing inventory records, logistics data, sales analytics and details of store and fulfillment infrastructure. The group’s claims have not been verified, and no sample of the data has been confirmed as authentic. The claim was reported with reference to The Times.
Nothing in the claim describes customer-facing data such as payment cards or account details. The material the group says it holds is operational.
The reporting rests on a single article citing The Times, and no sample of the claimed data has been described as examined by outside researchers. The H&M statement is the only on-the-record response, and it does not confirm that any database was accessed.
What H&M Told The Times
An H&M spokesperson told The Times that the company is aware of “claims circulating online regarding a potential cybersecurity incident involving a limited scope of H&M Group data.” The spokesperson said the company is investigating and has found no indication so far that its data environment was compromised.
H&M’s statement does not deny the claim outright. It acknowledges awareness of the claim, describes the scope as limited and leaves the investigation open.
H&M’s Scale Raises the Stakes of Any Confirmed Incident
H&M operates about 4,000 stores in more than 80 markets. Its brands include COS, Weekday, & Other Stories and Arket. If the group’s claim proves accurate, the data it describes would cover a large, global retail footprint, though the claim does not say how much of that footprint the databases represent.
The group’s claim refers to H&M Group as a whole, which includes its other brands, but the sources do not say which brands or regions the claimed databases cover.
A Second Retail Name in the News This Week
The claim surfaced as ASOS confirmed a separate breach last week. The two cases are unrelated in the reporting, and the sources do not link the ASOS incident to ShinyHunters.
What Remains Unconfirmed
The claim and the company statement describe two different pictures. ShinyHunters says it holds records across inventory, logistics, sales analytics and infrastructure, which would span several parts of a retail operation. H&M refers to “a limited scope of H&M Group data” and, in the same statement, says it has seen no indication of compromise to its data environment. The two positions are not necessarily contradictory: a limited scope could still be real, and an investigation that has just begun may not yet have located it.
Several points are unsettled. The reporting describes no published samples, and H&M has not confirmed or ruled out an intrusion. The reporting does not say how the group obtained access, whether it has demanded payment or whether it has set a deadline.
The claimed data is operational, not customer-facing. Inventory, logistics and sales analytics describe how a retailer moves goods and measures performance. The sources do not say whether any personal information is among the files ShinyHunters says it holds, and the claim’s reference to details of store and fulfillment infrastructure is not defined further.
The Open Questions for H&M’s Investigation
The retailer has described the scope as limited, and the group has yet to offer proof that would let outsiders test the claim. H&M has not said how long its investigation will take or whether it will confirm its findings publicly. Until one side provides evidence, the episode remains an assertion by ShinyHunters set against a company statement that stops short of a denial.
