Shein wants to build supply chain giant, some fear China cyber spying

The rise of Asian fast fashion retailer Shein already has Amazon on alert, but its plans of selling proprietary supply-chain technology and services to companies around the world has attracted attention from another corner: U.S. cybersecurity firms and national security experts who warn of the potential for a company with close ties to China spying on the supply chain as it seeks to grow its global logistics footprint.

Shein logistics software is in beta testing with select supply chain customers, according to a person familiar with its plans.

The U.S. supply chain has millions of connection points that link companies of all sizes. What makes the connections hum are application programming interfaces, or APIs, used by companies to increase efficiencies and save money. API software allows applications to communicate with each other in real-time and is crucial to logistics companies to integrate with freight providers, streamline operations, and create efficiencies for providers in their supply chain and ultimately, the end customer.

“The APIs in the logistics infrastructure are very interconnected, often without cybersecurity being contemplated,” said Lee Kair, principal and head of the transportation and innovation practice at The Chertoff Group, who formerly served as a top official at the Transportation Security Administration.

Cyber​​security experts and policy analysts say the supply chain of vendors is constantly changing, and the potential to gain data access is as simple as identifying the weakest link in a company’s data network. Typically, small companies have more vulnerable back-office systems, with weaker cyber protocols. “There is a tremendous amount of logistics integration in the world of fast fashion. These integrations can be compromised for nefarious purposes to expose customer data or compromise other connected systems,” Kair said.

According to data from Exiger, a supply chain intelligence intelligence company used by the U.S. government and critical infrastructure industries for risk management, there is a complex web of entities connected to Shein which indicates the company’s supply chain is more expansive and complex than most people realize. 

Exiger data shows that while Shein has 44 direct relationships, such as with its parent company Zoetop, and discloses over 5,000 suppliers, an analysis of all of its materials producers shows a supply chain connectivity map that expands substantially. In all, 10,821 companies comprise a supply chain one tier away from Shein. Drilling down deeper into that network of those Shein partners, it expands to 50,000-plus entities, including major U.S. companies, such as Forever 21, operated by Authentic Holdings and mall operator Simon Property Group — both of which announced formal partnerships…