How Cyberattacks Actually Happen: The Methods Behind Breaches Like H&M's

On October 12, 2026, H&M Group said it was investigating online claims of a cybersecurity incident involving "a limited scope of H&M Group data," according to a company statement reported by Retail Gazette. The retailer said it had found no indication that its data environment had been compromised and had not notified the UK Information Commissioner's Office, according to Beinsure.

The claims surfaced days after fashion retailer ASOS confirmed a breach on October 6, in which attackers obtained an employee's login credentials by impersonating a trusted contact, then used those credentials to reach customer names and contact details stored on third-party platforms, per Beinsure's reporting. Retail Gazette noted that reports have linked the H&M allegations to the same cybercriminal group, ShinyHunters, though no independent confirmation ties the two incidents together.

Who is ShinyHunters?

ShinyHunters is a financially motivated hacking group that has been active since 2020 and is linked to breaches at more than 400 organizations, according to cybersecurity vendor DoControl. The group follows a "pay or leak" extortion model: it demands a ransom and threatens to publish stolen data on dark-web forums if the target does not pay, DoControl reported. Past targets named by DoControl include Salesforce, Google, Workday, Adidas, Coinbase, Qantas Airways, and Jaguar Land Rover.

The methods behind most breaches

DoControl's analysis describes five techniques the group has used: abusing stolen OAuth tokens to impersonate users and bypass multi-factor authentication; exploiting misconfigured settings in cloud platforms such as Salesforce Experience Cloud or Google Workspace; compromising trusted software vendors to reach their downstream customers at once; recruiting employees on Telegram channels in exchange for payment for access to internal systems; and using AI-generated voice calls that impersonate IT staff to trick staff into approving attacker-controlled applications.

These techniques mirror broader industry data. Verizon's 2026 Data Breach Investigations Report, cited by Help Net Security, found that exploitation of software vulnerabilities overtook stolen credentials as the most common way attackers first get into a network — the first time that has happened in the report's 19-year history. The same report found that only 26% of vulnerabilities on the US Cybersecurity and Infrastructure Security Agency's "known exploited" list had been fully patched by surveyed organizations, down from 38% a year earlier, and that the median time to patch a flaw had risen to 43 days.

Where the human factor fits in

Not every breach relies on a software flaw. Help Net Security's summary of the Verizon report found that breaches involving a human element — such as being tricked by a phishing message or phone call — remained common. The report also found that phishers generally had more success reaching victims through voice calls and text messages than through email, without giving an exact comparison figure, and noted that phone-based "vishing" has increasingly been used in ransomware and extortion schemes.

Third-party and supply-chain involvement in breaches rose 60% year-over-year, according to the same report, now present in close to half of all incidents — a pattern that matches how ASOS's attacker reached customer data through a third-party platform rather than ASOS's own core systems, per Beinsure's account of the incident.

What remains unconfirmed in the H&M case

As of the H&M statement reported by Retail Gazette, the company had not confirmed that any system was breached, and had not linked the claims definitively to ShinyHunters or to the ASOS incident. H&M said its investigation was ongoing and that it could not share further details at that stage, according to Beinsure's reporting of the company's statement.