H&M says it is investigating hacking claims as retail cyber risks spread

A confirmed breach at ASOS and claims of an attack on H&M have put retail cyber cover back in focus, Insurance Business reported on 12 October. ASOS said it holds cyber insurance with a large global provider, including business continuity protection, and that it is too early to put a figure on any effect on trading.

H&M is investigating claims, reported by The Times, that hackers linked to the ASOS incident also targeted it. The retailer said it had "found no indication" that its data environment had been compromised. Its shares fell about 1.4% in Stockholm trading the same day.

Insurance Business set out the costs such incidents can bring for insurers and insureds: forensic work, customer notification, legal advice and regulatory action after a data breach, and business interruption losses when an intrusion disrupts trading. As a reference point, it noted that Marks & Spencer reportedly received a £100m insurance payout after its 2025 cyberattack, which cost the retailer £324m in lost sales.

At ASOS, app users received an unauthorised push notification on 6 October, apparently sent by a group calling itself Xuanye. ASOS said an attacker posed as a trusted contact to obtain an employee's login details and used them to reach third-party platforms with customer data. It said payment card details and passwords were not accessed.