Asos — a London-based fashion platform serving more than 16 million active customers — disclosed last Tuesday that an alert appearing within its app had pointed to a possible access violation affecting both the retailer and its data storage partner, Snowflake. A separate media report noted that H&M was examining comparable allegations tied to the same group, which had operated under a distinct name in that case.
No data pointing to a security compromise was turned up in the clothing company's internal review. Questions about data protection have surfaced alongside share-price volatility, with both buyers and market participants weighing what the breach has confirmed against what remains unresolved.
For Justin Cappos — a computer science and engineering professor at New York University with a background in cybersecurity — the incident raises a broader question: whether fashion brands require their own standalone apps to function effectively. Cappos views this pattern as a byproduct of retail practices that trade discounts and app-exclusive pricing for personal data, and he noted that consumers face a trade-off whenever a free offer requires an app download and the personal details that accompany it.
The arrangement carries a cost for users, Cappos explained, noting that many applications function primarily as tools for harvesting personal data and tracking behaviour. Collecting that information, he said, gives the brand a fuller picture of who its customers are — a dynamic he linked to the question of why downloading an app triggers a price reduction.
According to findings published by Coresight Research, AI-driven tools have given brands the ability to maintain continuously updated portraits of individual shoppers, capturing turning points throughout a person's life — from a first transaction to milestones such as getting married or gaining greater spending power.
A scan of externally visible infrastructure belonging to fast fashion retailers — Asos, Shein, and Boohoo among those assessed — by Business Digital Index, a platform that produces real-time security ratings, turned up active corporate login credentials on dark web channels for roughly 60 per cent of the brands covered during the period under review.
Online purchases may involve a narrower set of personal details at the point of payment, though whether that translates to reduced overall risk depends on factors beyond the checkout process itself. Downloading an app, by contrast, demands additional permissions and leaves a persistent presence on the device regardless of whether the browser window has been closed.
Cappos noted that AI agents carry a distinct vulnerability profile — specifically their exposure to prompt injection, a technique through which an attacker manipulates a large language model into abandoning its original instructions in favour of unintended actions, something he described as an exploit that people would not typically fall for.
Cappos observed that those carrying out such intrusions tend to pursue whatever objectives they have set for themselves, and that organisations perceived as investing less in digital defences — unlike, for example, a financial institution — are more likely to draw their attention. In a statement, he added that targets are often selected simply because they appear vulnerable, and that the choice of a fashion-related company, though not immediately obvious in its reasoning, may reflect opportunistic selection.
