H&M is investigating claims of a possible cyberattack after allegations that hackers linked to a recent breach at British fashion retailer ASOS had also targeted the Swedish clothing giant, raising fresh questions about how compromised credentials and third-party platforms are exposing businesses to cyber losses.
According to The Times, H&M is examining information circulating online about a potential incident. The retailer said it had found no indication that its data environment had been compromised. Its shares fell approximately 1.4% in Stockholm trading on Monday (October 12).
The investigation follows a confirmed breach at ASOS, where attackers obtained employee login credentials through social engineering and used them to access customer information held on third-party platforms.
The incidents highlight a growing concern for cyber insurers: attackers can gain access to valuable corporate data through relatively narrow entry points, potentially creating significant privacy, extortion and reputational exposures without shutting down an organization's core systems.
On October 6, ASOS customers received an unauthorized push notification through the retailer's own app declaring that the company had been hacked. The message, apparently sent by a group calling itself Xuanye, claimed that attackers had compromised the company's Snowflake cloud data environment and threatened to leak information.
ASOS subsequently confirmed that an attacker had impersonated a trusted contact to obtain an employee's login credentials.
Those credentials were used to access third-party platforms containing customer names, contact details and certain account-related information. The company said payment card details and account passwords were not accessed, and that its website and app remained operational.
The hackers' broader claims concerning Snowflake have not been independently established.
The same group has also claimed responsibility for a separate incident involving Air France-KLM, according to City AM.
The airline group confirmed detecting unauthorized access to internal folders, despite mandatory multifactor authentication. However, it said the folders did not contain sensitive data and the incident had no impact on customers, service continuity or partner systems.
The distinction between stolen data and operational disruption could materially affect how insurers respond to these incidents.
A breach involving customer information may trigger forensic investigation, breach notification, legal defense and regulatory response costs. A more serious intrusion affecting retail operations could also generate business interruption losses.
ASOS explicitly referenced its cyber insurance in its October 6 London Stock Exchange announcement, confirming that it holds coverage with a large global provider, including business continuity protection. It said it was too early to quantify any impact on trading.
The incidents also come against the backdrop of significant cyber losses elsewhere in retail. Marks & Spencer received a reported £100 million insurance payout following its 2025 cyberattack, which resulted in £324 million in lost sales.
