It wasn’t a secret. It was a notification—a ransom note in over a hundred characters—that suddenly popped up on the mobile app of a popular fashion brand that has over 16 million active users globally.
London-based fashion brand Asos saw a data breach by a group of hackers last Tuesday who posted an in-app notification that said Asos has been “hacked” and that its data storage provider Snowflake had been “fully compromised.”
This week, U.K. newspaper the Times reported that H&M is currently investigating claims that it has also been hacked by the same group of hackers, although they went by a different name. The Swedish clothing brand said that no breach has been found.
Whether or not these are related events, it understandably raises consumer concerns about data security, not to mention stock drops, as shoppers and investors grapple with what they know about the hack and, more concerningly, what they don’t.
For well-renowned cybersecurity expert Justin Cappos, this begs another equally important question: Why do fashion brands need to have their own apps in the first place?
An appetite for data, but not security
Cappos, a professor in the Computer Science and Engineering department at New York University, considers this a consequence of the current data-hungry retail culture that baits shoppers with incentives like retail discounts and app-only pricing in exchange of downloading the app.
“I do think that users should be much more cautious about where they provide their information,” he told Sourcing Journal. “They should be thinking: Why am I getting free stuff for providing this information? Why is installing this app giving me this discount? What does the company get out of it?”
“It’s not a free lunch,” he said. “In many cases, apps are just ways of gathering data and monitoring things about users. That data has some value for the brand because they know more about their customers. But if you’re going to collect data, you better protect it.”
It’s data gathering that goes beyond basic information such as name and e-mail address. According to a report from Coresight Research, brands can now use AI to continuously collect and update customer profiles throughout their lives, identifying “key milestones for the customer, including first purchase, marriage and increased spending power.”
This raises red flags because fashion has not shown a strong propensity for cybersecurity. An analysis of popular fast fashion retailers last year including Asos, Shein, and Boohoo showed that 65 percent of companies have their corporate credentials actively circulating on the dark web, according to Business Digital Index, a cybersecurity reputation platform that provides organizations with real-time security ratings based on scans of their externally facing systems.
AI agents are “vulnerable”
Purchasing from an online website, for example, comes with less risk because checking out requires less user information, he said. Installing an app, however, requires more, and it stays on the phone even after closing the window.
Numerous surveys show consumers still don’t trust AI enough to allow it to use their own hard-earned money on their behalf. Meta has been aggressively countering this consumer distrust with a cute and fuzzy personal AI agent called Muse, which can, among other tasks, shop and check out.
Incidents like the breach might hold the momentum of such innovations back as consumers pause and ask whether they are ready to take that leap, especially when AI agents are not necessarily better at detecting fraudulent schemes.
AI agents are, as Cappos said, “differently vulnerable.”
For example, he said AI agents are open to prompt injection, wherein an attacker might deceive a large language model to ignore original instructions and do something else instead. “That’s the kind of stuff a human isn’t going to usually fall for,” he said.
Cappos could not say for sure why hackers would target Asos, since they typically come with their own agenda. They often go for weak targets, he said, eyeing companies in industries that don’t necessarily put as much premium to cybersecurity as a bank, for example.
“In many cases, they’re often just attacking targets that seem weak.” He said. “Maybe they just hate fashion…but for some reason, they went after this.”