It was not a hidden vulnerability or an encrypted warning sent to a corporate inbox. Instead, it was a blunt notification—a ransom note consisting of over a hundred characters—that suddenly popped up directly on the mobile app of a major fashion brand boasting more than 16 million active users globally.
London-based fast-fashion giant Asos became the center of a high-profile cybersecurity incident last Tuesday when a group of hackers breached its systems. The perpetrators utilized the brand’s official in-app notification system to broadcast a stark message declaring that Asos had been "hacked" and that its third-party data storage provider, Snowflake, had been "fully compromised."
The breach immediately sent ripples through the retail and tech sectors. Compounding these worries, the U.K. newspaper The Times reported this week that H&M is actively investigating claims that it has also been targeted by the same cybercriminal collective, albeit under a different operating alias. While the Swedish clothing giant stated that its internal investigations have found no evidence of a breach thus far, the simultaneous scrutiny has placed the entire apparel industry on high alert.
Whether or not these incidents are directly coordinated or related, the developments have understandably ignited widespread consumer concerns regarding digital data security. Investors have similarly reacted, with stock values facing downward pressure as shoppers and stakeholders grapple with what is currently known about the security failures and, more troublingly, the vast amounts of information that remain obscured.
For prominent cybersecurity expert Justin Cappos, these headline-grabbing incidents expose a much deeper and systemic issue within modern retail, forcing an evaluation of an industry-wide practice: Why do fashion brands feel compelled to develop and maintain their own proprietary mobile applications in the first place?
An Appetite for Data, but Not Security
Cappos, a professor in the Computer Science and Engineering department at New York University, views the proliferation of retail shopping apps as a direct consequence of a data-hungry retail culture. This ecosystem constantly baits consumers with enticing incentives—such as exclusive retail discounts, loyalty points, and app-only pricing tiers—all in exchange for downloading software that requests deep access to personal devices and continuous behavioral tracking.
"I do think that users should be much more cautious about where they provide their information," Cappos noted in an interview with Sourcing Journal. "They should be thinking: Why am I getting free stuff for providing this information? Why is installing this app giving me this discount? What does the company get out of it?"
He emphasized that modern consumer interactions are rarely benign. "It’s not a free lunch," Cappos said. "In many cases, apps are just ways of gathering data and monitoring things about users. That data has some value for the brand because they know more about their customers. But if you’re going to collect data, you better protect it."
The scale of data collection practiced by contemporary retailers often extends far beyond basic, transactional details like a customer’s name, shipping address, and email inbox. According to recent research from Coresight Research, sophisticated apparel brands are increasingly leveraging artificial intelligence tools to continuously collect, aggregate, and update customer profiles throughout their entire consumer lifecycles. These systems are designed to identify and map out "key milestones for the customer, including first purchase, marriage, and increased spending power."
This aggressive harvesting of personal metrics raises serious red flags when viewed alongside the fashion sector’s historical negligence toward robust digital defense mechanisms. An extensive analysis of popular fast-fashion retailers conducted last year—covering major market players such as Asos, Shein, and Boohoo—revealed that roughly 65 percent of these companies had corporate credentials actively circulating on the dark web. These findings come from the Business Digital Index, a specialized cybersecurity reputation platform that provides organizations with real-time security ratings based on automated scans of their externally facing digital infrastructure.
AI Agents Are Vulnerable
The methods by which consumers interact with digital storefronts heavily dictate the level of risk they assume, according to industry experts. Purchasing items through a standard web browser, for example, typically involves a lower overall risk profile because the checkout process often requires fewer persistent permissions and a smaller footprint of user information. Installing a dedicated mobile application, however, requires deeper system integration, and the software—along with its background tracking mechanisms and stored credentials—remains active on a user’s smartphone long after the shopping window is closed.
Despite these latent security risks, the retail and technology sectors are pushing hard into the next frontier of consumer automation. Numerous recent consumer surveys consistently show that everyday shoppers still harbor deep distrust toward artificial intelligence, particularly when it comes to allowing automated systems to handle hard-earned money and execute purchases on their behalf.
Major technology firms are investing heavily to overcome this psychological barrier. Meta, for instance, has been aggressively working to counter consumer hesitation by introducing a friendly personal AI agent named Muse. Among a variety of daily tasks, Muse is designed to seamlessly handle consumer shopping excursions and complete digital checkouts autonomously.
However, high-profile security breaches like the one experienced by Asos threaten to stall the momentum behind such technological innovations. Incidents of this magnitude cause consumers to pause and question whether they are truly ready to take the leap into fully automated commerce, especially when the underlying AI agents are not inherently equipped to detect sophisticated fraudulent schemes or malicious manipulation.
AI agents present unique security challenges, operating in ways that differ fundamentally from traditional software vulnerabilities. As Cappos pointed out, these systems are "differently vulnerable."
He highlighted the specific threat of prompt injection attacks, a technique in which a malicious actor deceives a large language model into ignoring its original programming and safety instructions, executing unintended or harmful commands instead. "That’s the kind of stuff a human isn’t going to usually fall for," Cappos explained, noting that human intuition often acts as a natural firewall against bizarre or contradictory instructions that an AI might blindly process.
While the exact motivations behind the cyberattack on Asos remain opaque, security analysts note that malicious hacking groups frequently operate with diverse and shifting agendas. They tend to seek out soft targets, intentionally focusing their efforts on industries that do not inherently prioritize cybersecurity to the same rigorous degree as financial institutions or banking networks.
"In many cases, they’re often just attacking targets that seem weak," Cappos observed. "Maybe they just hate fashion… but for some reason, they went after this."
