The Swedish fashion retailer is examining reports of a possible cybersecurity incident, highlighting the growing importance of data protection and digital security across the global fashion industry
Stockholm, Sweden, 13 October 2026 – As fashion retailers expand their online shopping platforms and digital services, protecting customer information has become an increasingly important business priority. H&M Group, the Swedish company behind H&M and several other fashion brands, is investigating claims of a potential cyberattack. The company has acknowledged the reports but stated that its investigation has not identified evidence of a compromise to its data environment so far.
The investigation follows reports that cybercriminals may have targeted the company. According to media reports, the incident could be connected to ShinyHunters, a financially motivated cybercriminal group known for using social engineering techniques and phishing attacks to gain access to corporate systems. However, H&M has not confirmed that the group successfully breached its systems, and the claims remain under investigation.
In response to the reports, an H&M Group spokesperson said the company was aware of claims concerning a potential cybersecurity incident involving a limited amount of company data. The spokesperson also emphasised that protecting its systems and information remains a priority. The company is assessing the validity of the claims and has said it cannot provide further details while the investigation continues.
H&M operates thousands of stores across international markets and manages a substantial online retail business. Its portfolio includes brands such as COS, Arket and Monki, alongside its flagship H&M business. Managing customer accounts, online transactions, inventory systems and digital communications across such a large operation requires secure technology infrastructure and effective monitoring.
The reports have also drawn attention to the cybersecurity risks associated with third-party technology providers. Retailers frequently rely on external platforms for customer relationship management, cloud storage, marketing communications and other digital services. Although these systems improve operational efficiency, weaknesses in account security or access controls can create opportunities for unauthorised access.
The potential incident comes amid wider concerns about cybersecurity across fashion retail. British online fashion retailer ASOS has also reported unauthorised access involving an employee account and certain third-party platforms. Some customer information, including names and contact details, may have been accessed, while account passwords and payment card information were not believed to have been compromised. Such incidents have raised broader questions about employee account security and customer data protection across the retail sector.
Cybersecurity threats are particularly challenging for retailers because their businesses depend on interconnected systems, continuous online availability and customer trust. A security incident can affect more than confidential information. Depending on its severity, it can disrupt online orders, delay deliveries, interrupt internal operations, and create additional costs for investigation and recovery.
For fashion companies, effective cybersecurity increasingly requires a combination of secure authentication, employee awareness, regular system assessments, and careful management of external technology providers. Businesses must also establish clear procedures for responding to suspicious activity and communicating with customers when their information may be at risk.
H&M’s investigation remains ongoing, and the company has not confirmed a successful data breach. The outcome will determine whether further action is required and whether any information was affected.
The situation nevertheless highlights a growing challenge for the fashion industry. As retailers continue investing in e-commerce, personalised shopping experiences and connected digital operations, cybersecurity must remain central to their business strategies. Protecting customer information is not simply a technical responsibility. It is essential to maintaining consumer confidence and ensuring the long-term resilience of digital retail.