H&M Group said it is investigating online claims of a possible cybersecurity incident but has so far found no indication that its data environment has been compromised, the U.K. fashion trade publication Drapers reported Monday. The Swedish retailer is the second big fashion name in a week to face hacking claims, after ASOS. Its cautious statement, issued before it knows whether the claims are true, shows the kind of disclosure choice boards now face within hours.

What Happened

The Times first reported the claims Monday, according to Drapers. In its statement, H&M said it was aware of information circulating online about a potential incident and was examining it. The Independent, citing the company's spokeswoman, reported that the claims concern "a limited scope of H&M Group data" and that H&M could give no further details while its work continues.

H&M told Drapers it had not notified the U.K. Information Commissioner's Office (ICO), the data protection regulator, because it had found no sign of a compromise. The Times reported that the ICO had received no report as of Monday lunchtime, according to The Independent and TheIndustry.fashion. Under U.K. rules, organizations must report a personal data breach to the ICO within 72 hours of becoming aware of it, unless it is unlikely to put people's rights and freedoms at risk.

RelatedCybersecurity Incident at BAE Systems Halts Notices From U.S. Bankruptcy Courts

Drapers reported that the claims were made by a group calling itself ShinyHunters, which also said it operates as the "Xuanye" group. Unnamed sources told The Times they believed the same group targeted ASOS the previous week, Drapers reported. H&M has not confirmed any of this, and no authority has attributed the claims.

H&M shares fell about 1.5% on the Stockholm exchange Monday, The Independent reported. As of Tuesday morning, H&M Group's corporate newsroom carried no statement on the claims. The group, which also owns COS, Arket, Weekday and & Other Stories, runs about 4,000 stores in more than 80 markets, The Independent reported.

Why It Matters

Even an unverified claim moved H&M's share price, and the company now has to decide what to say, and to whom, before it knows what happened. Its approach so far is to acknowledge the claims, say what it has and has not found and hold off on a regulatory report. That works while the evidence supports it. If the company later finds personal data was taken, the 72-hour clock starts from when it becomes aware of the breach.

For other retailers, the sequence matters as much as the target. ASOS says an attacker posed as a trusted contact to get an employee's login and then reached customer data on third-party platforms. That breach became public through an extortion message pushed to app users Oct. 6. Insurance Business, citing City AM, reported that a group calling itself Xuanye has also claimed an incident at Air France-KLM. The pattern points boards to the accounts and outside services that staff and vendors use, not only to core systems.

The ShinyHunters name carries weight with investigators. Authorities in the Netherlands and Jordan have detained alleged members in recent weeks, as The Primary Wire has reported. Whether the people now using the name are connected to that group has not been established.

What to Watch

The key question is whether H&M confirms or rules out data theft once its review ends. Watch also whether the claimants publish samples, and whether H&M notifies the ICO or Sweden's data protection authority. Investigators may also tie the claims to the ASOS breach and the earlier Xuanye claims, or rule out a link.