Breaches

H&M extortion claim points to warehouse software supplier

H&M still sees no compromise, but researchers trace leaked samples to warehouse supplier GreyOrange as attackers set a three-day leak deadline.

Warning symbol over a retail warehouse network illustrating the H&M data extortion claim

H&M Group is still investigating claims that a criminal crew stole a slice of its operational data, and researchers now say the leaked samples look like they came from a warehouse software supplier rather than H&M’s own estate. The attackers have reportedly given the retailer three days to make contact before they publish.

What happened

On Monday 12 October 2026, The Times reported that H&M Group, the Swedish owner of H&M, Cos, Arket, Weekday and Monki, was looking into claims that it had been hit by cyber criminals the week before. Several outlets linked the claims to ShinyHunters, the financially motivated extortion brand associated with a long run of social engineering and cloud data theft cases.

H&M’s position has not changed since then. A spokeswoman told The Times the business knew about claims concerning “a limited scope of H&M Group data”, and the company told Swedish news agency TT that it had so far found no sign of compromise in its data environment. It has declined to say more while the investigation runs. The Times said no breach report had reached the Information Commissioner’s Office by Monday lunchtime, and the PA news agency noted it was unclear whether the NCSC had been contacted.

By Tuesday, Cybernews reported that the people behind the claim were describing the stolen material as inventory records, logistics data, sales analytics and details of the systems H&M uses to run stores and fulfil orders. None of that has been independently verified.

The material development came on Wednesday 14 October. Cybernews researchers said the sample files being shared on Telegram appear to originate from GreyOrange, a warehouse inventory management platform that lists H&M among its customers. The same posts reportedly carry an ultimatum: H&M has three days to get in touch or the dataset will be dumped. Neither H&M nor GreyOrange had commented on the supplier link when Cybernews published, and I could find no further statement from either company at the time of writing.

The technical picture

According to Cybernews, the sample attached to the Telegram posts is a small set of JSON records holding product information, including product image URLs and identifiers that tie back to H&M. That is consistent with data held in a warehouse or fulfilment system, which needs to know what every item is, where it sits and where it is going. It is not, on its face, customer or employee personal data, and the researchers stressed that the samples do not prove anyone reached sensitive records. How far any exposure goes would depend on how the supplier’s platform is built and integrated with H&M’s systems.

Attribution is also shaky. Cybernews said a threat tracking service, Vercert, recorded the H&M dataset appearing on underground forums and credited it to ShinyHunters. When the researchers checked, the account behind that entry was marked as retired, no matching listing could be found, the group’s onion leak site was offline, and its data server held nothing about H&M. Their view was that this could be other criminals borrowing the ShinyHunters name. Separately, sources quoted by The Times pointed to the crew behind the earlier Asos intrusion, which has been associated with a group calling itself Xuanye. UK consultancy CyPro has cautioned that none of these attributions has been corroborated for H&M.

So the defensible reading today is this: someone holds what looks like genuine H&M product and logistics data, the most likely source is a third-party platform, and the label on the extortion demand may be borrowed.

Timeline of the H&M extortion claim from the Asos incident on 6 October to the GreyOrange supplier link and leak deadline on 14 October 2026

Why it matters for UK organisations

H&M runs one of the larger fashion store estates on British high streets, and this lands in the middle of a bruising autumn for UK retail. Asos confirmed earlier this month that an attacker used a socially engineered employee login to reach third-party customer communication platforms and push a rogue alert to app users. There is no confirmed link between the cases, but the pattern is familiar: the weak point is often a supplier platform or a trusted user account rather than the retailer’s core network.

That matters for UK GDPR. If personal data turns out to be involved, the controller has 72 hours from becoming aware of a personal data breach to tell the ICO, unless the breach is unlikely to risk individuals’ rights and freedoms. Supplier-side incidents make that clock harder to manage, because the retailer may learn of the problem second-hand, sometimes from a journalist or a Telegram channel. Contracts that require prompt notification from processors are only useful if they are tested.

Operational data is also more sensitive than many boards assume. Inventory flows, store infrastructure details and fulfilment logic do not trigger breach notifications, but they are a useful map for anyone planning fraud, supply chain disruption or a follow-on intrusion.

Expert view

When we scope retail assessments, warehouse management, logistics and store systems are often treated as out of scope because they belong to a supplier. That is exactly where trouble tends to hide. These platforms usually hold long-lived API keys or service accounts with broad read access to product and order data, and they are rarely monitored as closely as the e-commerce front end.

The attribution confusion is also typical. Brand names such as ShinyHunters carry weight, so lesser crews borrow them to pile on pressure. In my experience that changes the conversation with the attacker very little, but it should change how much faith you put in their claims about what they hold. Short deadlines and small teaser samples are pressure tactics, not proof of a deep compromise.

H&M’s careful wording about its own data environment may be accurate and still leave room for a supplier-side exposure.

What to do now

  1. Map supplier data flows. List every third-party platform that receives product, order, logistics or customer data, and record what credentials and integrations connect it to your estate.
  2. Rotate and scope integration secrets. Review API keys, service accounts and tokens shared with warehouse and fulfilment suppliers. Apply least privilege and short lifetimes, in line with the Cyber Essentials user access control requirements.
  3. Enforce phishing-resistant MFA for staff and supplier users on SaaS admin consoles, messaging and marketing tools. The Asos case shows how far one tricked login can travel.
  4. Test supplier breach notification. Confirm contracts oblige processors to report suspected incidents quickly enough for you to meet the ICO’s 72-hour window, and run a tabletop that starts with a claim surfacing on Telegram.
  5. Prepare an extortion playbook. Decide in advance who validates leaked samples, who talks to law enforcement and the ICO, and how you will warn customers about follow-on phishing.
  6. Watch for brand-led phishing. Retail incidents attract opportunistic scam emails and texts. Brief customer service teams and publish clear guidance through trusted channels.

Bottom line

Nothing so far shows that H&M’s own systems were breached, and the ShinyHunters label looks doubtful. But a three-day leak deadline and samples apparently traced to a warehouse supplier mean this has moved beyond online rumour. For UK retailers, the lesson is the same one the past month keeps teaching: your exposure is only as good as the least-watched platform that holds your data.

Sources

Related Posts