INDEX / DIRECTORY / H&M / V-DIG

H&M V-DIG

DIGITAL INFRASTRUCTURE AUDIT UPDATED 2026-05-19
V-DIG Score 0.05 /10 E H&M — BDS-1000 86
V-DIG 0.05

Evidence-only forensic audit. Scoring happens downstream — see the main dossier for the composite assessment.

V-DIG Audit: H&M

H&M Group — V-DIG Audit: Domain Audit Report

Enterprise Technology Stack & Vendor Relationships

H&M announced a strategic partnership with Google Cloud in June 2022 to build an enterprise data backbone, AI/ML capabilities, and data mesh integration across the company’s global operations12. Google Cloud operates a Tel Aviv region that serves as sovereign infrastructure for Project Nimbus, a $1.2 billion contract awarded to Google and Amazon in 2021 that is largely funded by the Israeli Ministry of Defence345. The Project Nimbus contract contractually bars Google and Amazon from restricting Israeli military or security usage, and the Israeli Ministry of Defence is a documented Google Cloud customer345. H&M’s partnership announcement does not specify data residency, and no public evidence identifies whether H&M customer data is stored in, routed through, or processed in Google’s Tel Aviv region2. H&M’s voice-activated interactive mirror at its New York City Times Square flagship uses Microsoft Azure for facial and speech recognition capabilities, with the mirror built by Ombori AG (Swiss) and Visual Art (Swedish) in association with Microsoft67. Microsoft Azure also powers broader H&M retail technology pilots, and Microsoft is named in UN Special Rapporteur reporting (A/HRC/59/23) as providing government-wide cloud and AI access to the Israeli government alongside Google and Amazon36. ENI Advanced Security Solutions lists H&M as a client alongside Partner (Israeli telecom) and Bazan Group (Oil Refineries Ltd.)8. ENI won the Shomron regional council tender for peripheral security systems at Barkan settlement in the West Bank, with a command centre controlling over 100 cameras and electronic fencing8. ENI also established security systems at the City of David settler complex in Silwan, East Jerusalem8. G1 Secure Solutions (formerly G4S Israel) lists H&M as a client alongside Apple, Nike, Coca-Cola, Amazon, and Adidas9. G1 provides CCTV systems to the Israeli Ministry of Public Security’s “Safe City” project deployed in West Bank settlement municipalities9. G1 also provides services to Israeli checkpoints (Erez, Qalandia, Bethlehem, Irtah), prisons (Ofer, Megido, Ketziot, Shata, Damon), Israel Police, and the National Police Academy9. Contract dates, scope, and current active or terminated status for both ENI and G1 relationships with H&M are not specified in available sources89. H&M’s COS brand technology partner for its Beverly Hills smart store is GreyOrange, an India-founded and Atlanta-headquartered company providing the gStore SaaS platform101112. GreyOrange’s privacy policy notes Israeli sales partners13. No public evidence identified that H&M holds direct licensing, subscription, or integration relationships with Check Point, Wiz, SentinelOne, CyberArk, Nice, Verint, Claroty, Palo Alto Networks, Trigo, BriefCam, Trax, or AnyVision/Oosto.

Surveillance, Biometrics & Retail Technology

H&M has deployed facial detection technology in its New York City Times Square flagship via voice-activated interactive mirrors that wake and engage when a person looks at the mirror for an extended period6147. The facial detection technology is powered by Microsoft Azure face recognition; the mirror was built by Ombori AG (Swiss) and Visual Art (Swedish)6147. H&M’s COS brand deployed smart mirrors with product recognition, RFID-enabled fitting room mirrors, virtual try-on, and personalised recommendations at its Beverly Hills store, powered by GreyOrange gStore SaaS10151112. AnyVision Interactive Technologies (renamed Oosto post-2021) is an Israeli facial recognition firm documented by Who Profits as providing technology to Israeli military West Bank surveillance projects and awarded a contract by the Israeli Ministry of Defence in 201816. Oosto markets retail as a vertical16. No public evidence identified connects H&M to AnyVision/Oosto facial recognition technology. H&M was fined €35.3 million in October 2020 by the Hamburg Data Protection Authority for systematic illegal surveillance of employees at its Nuremberg service centre, including recording details of family problems, religious beliefs, illness diagnoses, and holiday experiences17. This surveillance was conducted by H&M itself, not an Israeli vendor17. No public evidence identified that Israeli-origin surveillance or biometrics technology reaches H&M indirectly via third-party platform providers, bundled enterprise suites, or managed security services. No public evidence identified connecting H&M to Trigo, BriefCam, or Trax, Israeli-origin retail technology vendors.

Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

No public evidence identified that H&M operates, leases, or co-locates data centre infrastructure within Israel. No public evidence identified that H&M directly participates in Project Nimbus or comparable Israeli government cloud programmes as a contractor. H&M’s enterprise cloud partner Google Cloud operates a Tel Aviv region that serves as the sovereign infrastructure for Project Nimbus, with Google Cloud as prime contractor serving the Israeli Ministry of Defence under a contract that bars Google from restricting military or security usage2345. H&M’s own data residency within Google Cloud infrastructure—including whether H&M data touches the Tel Aviv region or is subject to Israeli data sovereignty law—is unconfirmed2. No public evidence identified that H&M provides services explicitly marketed or contracted to ensure digital sovereignty, data residency, or infrastructure resilience for Israeli state institutions or military bodies.

Defence, Intelligence & Security Sector Technology Relationships

No public evidence identified of direct contracts, partnerships, or service agreements between H&M and the Israeli Ministry of Defence, IDF, Mossad, Shin Bet, or other Israeli state security bodies. No public evidence identified that H&M’s commercially available technology has been publicly reported, confirmed by official sources, or documented by researchers as being deployed for military, intelligence, or law enforcement surveillance applications within Israel or occupied territories. No public evidence identified of H&M developing, selling, licensing, or maintaining offensive cyber capabilities, zero-day exploit tools, or digital weapons systems. Union Group, the parent of H&M’s Israeli franchisee Match Retail, operates Union Tech Ventures, a technology investment vehicle that has invested in Xtend, an Israeli defence-tech company developing tactical autonomous AI drones (SKYLORD, Wolverine lines) and XOS software1819. Xtend is described as “battle-proven” in Gaza, Lebanon, and Ukraine, with documented contracts with both the U.S. Department of Defense and the Israel Defence Forces18. Union Tech Ventures Managing Director Tal Recanati described Xtend as “defense technology”18. This investment relationship is between Union Tech Ventures and Xtend; no evidence establishes that H&M’s retail operations directly benefit from or are connected to Xtend technology1819.

AI, Algorithmic & Autonomous Systems

No public evidence identified of H&M providing artificial intelligence, machine learning, computer vision, or autonomous decision-support systems to Israeli state, military, or security bodies. No public evidence identified of H&M’s AI models or platforms being trained on, or provided access to, civilian population data, intercepted communications, or surveillance-derived datasets originating from Israel or occupied territories. No public evidence identified of H&M providing autonomous target generation, automated threat detection, or autonomous tracking systems to Israeli military or security forces.

Technology Ecosystem & R&D Footprint

No public evidence identified of H&M operating research and development facilities, engineering offices, innovation labs, or accelerator programmes within Israel. No public evidence identified of H&M acquiring Israeli-origin technology companies or making strategic investments in Israeli technology startups or venture funds. The Union Group (H&M franchisee’s parent) operates Union Tech Ventures, which has invested in Israeli defence-tech company Xtend—this is not a direct H&M corporate act1819. No public evidence identified of H&M holding significant patent portfolios, licensing agreements, or co-development arrangements with Israeli-domiciled entities or research institutions such as Technion, Hebrew University, or Weizmann Institute.

Civil Society Scrutiny & Regulatory History

Who Profits, a research centre documenting corporate involvement in the Israeli occupation, lists H&M as a client of ENI Advanced Security Solutions, a company providing settlement-area security systems8. Who Profits also lists H&M as a client of G1 Secure Solutions, formerly G4S Israel, which provides CCTV to West Bank settlement municipalities, checkpoints, and prisons9. The UN OHCHR Settlement Business Database (A/HRC/60/19, September 2025) does not list H&M among the 158 companies documented in the settlement business database20. No H&M entry was identified on the American Friends Service Committee’s Investigate platform or on Don’t Buy Into Occupation in searches conducted across all research rounds. H&M has been a named boycott target of the BDS Movement since 2010, with the campaign beginning in protest of H&M’s Israeli franchise launch and citing “whitewashing Israel’s colonization of Jerusalem”21. Protests were organized at Azrieli Mall in Tel Aviv and Malcha Mall in Jerusalem store openings in 20102122. The BDS campaign continued through 2024–20252122. The campaign grounds cited Israeli operations in occupied Jerusalem and broader Israeli settlement activity2122. Canadians for Justice and Peace in the Middle East maintains a H&M boycott factsheet listing four H&M stores in Israel, including Malcha Mall in Jerusalem (East Jerusalem)23. H&M Israel is operated as a franchise by Match Retail Ltd., a company whose LinkedIn page indicates active operations as of 2025–2026 with 11–50 employees24. H&M entered into a franchise agreement for store openings in Israel in December 2008, with the first four franchise stores confirmed opening in Azrieli Mall Tel Aviv, Jerusalem, Haifa, and Kfar Saba12526. The UN Special Rapporteur report (A/HRC/59/23, July 2025) documents Google Cloud’s Tel Aviv region serving Project Nimbus and Israeli Ministry of Defence cloud and AI infrastructure, but does not name H&M or its Google Cloud partnership3. Reddit community discussions in 2025 document continued organized calls to boycott H&M over Israeli operations. H&M’s Israeli operations were reportedly targeted by Iranian hacker group N3tw0rm (affiliated with Pay2Key) in 2024, with claims of 110 gigabytes of stolen customer data27. This is a documented data security incident rather than a regulatory or legal action against H&M27. CEO Daniel Ervér stated in March 2026 that the Middle East represents “small sales exposure” with stores run by franchisees, indicating continued operations3. No public evidence identified of H&M issuing any public statement, press release, or corporate disclosure addressing the International Court of Justice Advisory Opinion (July 2024) or International Criminal Court arrest warrants (November 2024), or of H&M having modified, suspended, or ceased its Israeli franchise operations following these events. No OECD National Contact Point complaints specifically against H&M regarding Israeli technology relationships or settlement operations were identified in the OECD Watch complaints database or academic reviews of NCP activity in Palestinian territories.

End Notes

Footnotes

  1. https://hmgroup.com/news/hm-enters-into-franchise-agreement-for-store-openings-in-israel ↩ ↩2

  2. https://www.googlecloudpresscorner.com/2022-06-30/Google-Cloud-Announces-New-Partnership-with-Global-Fashion-Retailer ↩ ↩2 ↩3 ↩4

  3. https://www.ohchr.org/en/documents/country-reports/ahrc5923-economy-occupation-economy-genocide-report-special-rapporteur ↩ ↩2 ↩3 ↩4 ↩5 ↩6

  4. https://theintercept.com/2025/05/12/google-nimbus-israel-military-ai-human-rights ↩ ↩2 ↩3

  5. https://time.com/6966102/google-contract-israel-defense-ministry-gaza-war ↩ ↩2 ↩3

  6. https://ombori.com/a-first-look-at-the-h-m-interactive-mirror ↩ ↩2 ↩3 ↩4

  7. https://www.technologyrecord.com/article/hm-installs-azure-powered-magic-mirror-at-flagship-store ↩ ↩2 ↩3

  8. https://www.whoprofits.org/companies/company/4133 ↩ ↩2 ↩3 ↩4 ↩5

  9. https://www.whoprofits.org/companies/company/3798 ↩ ↩2 ↩3 ↩4 ↩5

  10. https://greyorange.com/customer_story/cos-hm-group-turns-stores-into-a-customer-experience-zone-with-gstore ↩ ↩2

  11. https://wwd.com/business-news/business-features/gstoer-cos-smart-store-beverly-hills-enabling-store-of-the-future-1235252520 ↩ ↩2

  12. https://greyorange.com/news/greyorange-news/cos-hm-group-turns-stores-into-a-customer-experience-zone-with-gstore ↩ ↩2

  13. https://greyorange.com/privacy-policy/ ↩

  14. https://www.retaildive.com/news/hm-tests-voice-activated-mirrors-at-nyc-flagship/525296 ↩ ↩2

  15. https://hmgroup.com/news/hm-group-explores-tech-enabled-shopping-experiences-in-us-stores ↩

  16. https://www.whoprofits.org/companies/company/6872/ar ↩ ↩2

  17. https://www.bbc.com/news/technology-54391636 ↩ ↩2

  18. https://www.prnewswire.com/news-releases/xtend-secures-30m-extension-to-complete-70m-series-b-to-scale-its-battle-proven-autonomous-ai-robots-across-america-302505642.html ↩ ↩2 ↩3 ↩4 ↩5

  19. https://uniontech.vc ↩ ↩2 ↩3

  20. https://www.ohchr.org/en/business/bhr-database ↩

  21. https://www.bdsmovement.net/news/hm-whitewashing-israels-colonization-of-jerusalem ↩ ↩2 ↩3 ↩4

  22. https://www.bdsmovement.net/news/swedish-fashion-chain-hm-under-pressure ↩ ↩2 ↩3

  23. https://www.cjpme.org/h_m ↩

  24. https://www.linkedin.com/company/h&m-israel-match-retail- ↩

  25. https://hmgroup.com/wp-content/uploads/2020/10/Annual_Report_2008_p2_en.pdf ↩

  26. https://hmgroup.com/wp-content/uploads/2020/10/Annual_Report_2010_p1_en.pdf ↩

  27. https://www.timesofisrael.com/hm-israel-said-targeted-by-iranian-cyberattack ↩ ↩2