Thought Leadership
Attackers are threatening H&M with a leak. Data samples point to warehouse management software GreyOrange. H&M currently sees no indications of a compromise.
Unknown attackers are threatening Swedish fashion group H&M with the publication of allegedly stolen data. On a Telegram channel, they set a deadline of three days to establish contact. Following initial reports of an attack, H&M stated that it was investigating the claims, but currently saw no evidence of a compromise. According to new findings, a supplier could be affected.
Doubts Over ShinyHunters’ Involvement
According to tracking service Vercert, a dataset associated with H&M surfaced on underground forums last week. The hacker group ShinyHunters was named as the author. According to the reports, the data allegedly involves warehouse inventories, logistics data, sales analytics, and details on infrastructure for retail stores and order fulfillment.
However, the research team at Cybernews did not find the corresponding post. The associated ShinyHunters account was marked as dormant, and the group’s leak site is offline. On the server where the group stores its datasets, which remains accessible, no data related to H&M was found. Instead, the dataset is circulating across several Telegram channels. Researchers therefore consider it likely that other perpetrators are impersonating ShinyHunters. In recent weeks, several alleged members of the group had been arrested.
Samples from Warehouse Management
Along with their threat, the new attackers published several records containing product information in JSON format. According to Cybernews, they originate from software by GreyOrange, which retailers use to manage warehouse inventories. H&M is listed as a client on GreyOrange’s website, as is Walmart Canada. The samples contain data that can be attributed to H&M, such as URLs for product images and various identifiers. “This does not necessarily mean that the attackers possess more sensitive information such as personal data belonging to employees,” the research team explained.
That depends on how the system architecture is designed and how GreyOrange is integrated into it. GreyOrange and H&M have not yet responded to inquiries from Cybernews.
(Editorial Team)
