H&M checks hacking claims days after ASOS breach; says no sign its systems were hit
Representative image: Pexels / Pixabay
H&M said on 12 October 2026 it is investigating online claims of a cyber incident, days after fashion retailer ASOS disclosed a breach of customer details.
What Happened
Swedish fashion group H&M said on Monday, 12 October 2026, that it is investigating online claims of a cybersecurity incident involving a limited amount of its data, but that it has so far found no indication that its data environment has been compromised. The claims surfaced less than a week after British online fashion retailer ASOS disclosed that an intruder had gained access to some customer information. A UK newspaper, citing unnamed sources, reported that the group behind the claims about H&M may be the same one that attacked ASOS. H&M shares fell about 1.3% on the day.
Key Facts
- H&M, whose group also owns Cos, Arket and Monki, said it is aware of online claims about a potential incident involving a limited amount of its data.
- The company said it has found no indication that its data environment was compromised and has not contacted the UK's data regulator, the Information Commissioner's Office.
- On 6 October, ASOS said it was investigating unauthorised activity on third-party platforms it uses to communicate with customers.
- ASOS said customers' names, contact details and certain account information may have been accessed, but it did not believe payment card details or passwords were compromised.
- ASOS said the intruder got into an employee account by impersonating a trusted contact to obtain login details.
- Reports have linked the claims to criminal groups known as ShinyHunters and a group calling itself Xuanye; this has not been confirmed by the companies.
- H&M shares fell about 1.3% on 12 October.
Why It Matters
Fashion retailers hold large amounts of personal data: names, addresses, phone numbers, order histories and, in many cases, saved payment methods. That makes them attractive targets for criminals, who can sell the information or use it to send convincing scam messages. The ASOS case shows how such attacks often work today. Instead of breaking through technical defences, the intruder tricked an employee by pretending to be someone they trusted, then used the stolen login to reach outside platforms that hold customer information.
For shoppers, the most immediate risk after this kind of breach is not usually direct theft from bank accounts, especially where card details were not taken. It is phishing: emails, texts or calls that use real details, such as a name and a recent order, to seem genuine, and then ask the customer to click a link, pay a fee or share a one-time password. Knowing that one's details may be in criminal hands is a reason to be extra careful with any unexpected message claiming to be from a retailer.
H&M's position is clear for now: it has found no sign of a breach. The claims may turn out to be false or exaggerated. But the episode underlines how retailers' use of third-party services, from customer messaging tools to marketing platforms, widens the number of places where data can leak.
| Company | What has been said |
|---|---|
| ASOS | Unauthorised access to third-party platforms; names, contact details and some account information may be affected; card details and passwords not believed affected |
| H&M | Investigating online claims; no indication its data environment was compromised |
Impact
Short-term: H&M will continue its investigation, and customers of both retailers may receive scam messages exploiting the news.
Long-term: Retailers are likely to tighten controls on employee logins and third-party platforms, and regulators may look more closely at how fashion companies protect customer data.
Who is affected: Customers of ASOS and possibly H&M; other online fashion retailers; and the third-party service providers that handle customer communications.
Key Takeaway
H&M says it has found no sign of a breach as it checks hacking claims made days after ASOS customer data was exposed, but shoppers should watch for scam messages.
Questions and Answers
Has H&M been hacked?
Not as far as the company knows. On 12 October 2026, H&M said it was investigating online claims but had found no indication that its data environment had been compromised.
What data was affected in the ASOS breach?
ASOS said customers' names, contact details and certain account information may have been accessed. It said it did not believe payment card details or passwords were compromised.
How did the ASOS attackers get in?
ASOS said the intruder accessed an employee account by impersonating a trusted contact to obtain login details, then used it to reach third-party platforms used to communicate with customers.
What should shoppers do?
Be cautious with unexpected emails, texts or calls that claim to be from a retailer, avoid clicking unfamiliar links, and never share one-time passwords.
Disclaimer: Prepared by the Peepals newsroom from publicly available sources with AI assistance. Information is accurate to the best of our knowledge at the time of publication and may change. Images may be representative. Not professional advice. Report an error via our contact page.
Sourced and fact-checked by the Peepals Global Editorial Team
Reported, fact-checked and published by the Peepals Global Editorial Team.
