INDEX / DIRECTORY / LIDL / V-DIG

Lidl V-DIG

DIGITAL INFRASTRUCTURE AUDIT UPDATED 2026-05-19
V-DIG Score 2.57 /10 D Lidl — BDS-1000 259
V-DIG 2.57

Evidence-only forensic audit. Scoring happens downstream — see the main dossier for the composite assessment.

Lidl — V-DIG Domain Audit

Enterprise Technology Stack & Vendor Relationships

Lidl’s parent company Schwarz Group acquired Israeli cybersecurity company XM Cyber in November 2021 for approximately $700 million 12. XM Cyber was co-founded by former Mossad Director Tamir Pardo, who served as company President 2. Tamir Pardo served as Director of Mossad from 2011 to 2016 prior to co-founding XM Cyber in 2016 2. XM Cyber specializes in breach and attack simulation technology for hybrid cloud environments 2. XM Cyber continues operating from Herzliya, Israel headquarters post-acquisition 2. Tamir Pardo retained an equity stake at the time of the acquisition and left XM Cyber in 2023, subsequently joining NanoLock Security Advisory Board 3.

Israeli state-cyber ecosystem nexus (Rafael / INCD consortium). On 1 June 2021, Rafael Advanced Defense Systems (a wholly Israeli state-owned defence prime) established the “Cyber OT Consortium” for critical-infrastructure (transport, energy, water, oil & gas) cyber defence, explicitly listing XM Cyber as a member alongside Israel Electric Corporation, Waterfall Security, Radiflow and others; the initiative was launched “in cooperation with the Israel National Cyber Directorate” (INCD, an agency of the Prime Minister’s Office), whose Director of Economy and Growth (Roi Yarom) publicly endorsed it 45. This places XM Cyber — now a wholly-owned Schwarz/Lidl subsidiary — within the Israeli national-security cyber-defence apparatus. Scope/scoping notes: (a) the consortium is defensive operational-technology security (protecting national infrastructure from cyberattack), not surveillance of Palestinians, kill-chain, or offensive tooling; (b) it was marketed partly toward Gulf/Dubai critical infrastructure post-Abraham-Accords, so it is not occupation-specific 6; (c) currency caveat — the consortium was announced in June 2021, before the November 2021 Schwarz acquisition, and no source confirms whether the membership has been maintained, wound down, or lapsed under Schwarz ownership (last confirmed 2021). This is a genuine but defensive, of-uncertain-currency V-DIG tie to the Israeli state-security ecosystem; it does not constitute a documented direct Israeli Ministry of Defence contract or Israel Innovation Authority grant, neither of which was identified for XM Cyber.

Dieter Schwarz’s family office investment vehicle, formerly known as Zukunftsfonds Heilbronn (ZFHN) and rebranded as D11Z.Ventures, invested approximately $6 million in Israeli company TinyInspektor (later Inspekto) in 2018 78. Inspekto develops fault detection technology for industrial production equipment 7. Dieter Schwarz is the founder, owner, and chairperson of Schwarz Group (Lidl and Kaufland), with an estimated worth of $20 billion 9.

Schwarz Group formed Schwarz Digits in September 2023 as the IT and digital services division encompassing cloud computing (STACKIT), cybersecurity (XM Cyber), and e-commerce for Lidl and Kaufland 10. Schwarz Digits generated approximately €1.9 billion in revenue in 2024/25 with 7,500 employees 10. The division is co-led by Christian Müller and Rolf Schumann 10. Schwarz Group is building an €11 billion data center campus in Lungen, Germany 10.

Lidl GB uses the Auror platform for retail crime intelligence and loss prevention 1112. Lidl GB’s privacy notice explicitly states the platform does NOT use facial recognition; cameras use non-scan detection at checkout points only with facial images pixelated 13. Lidl GB also deployed body-worn cameras chainwide in February 2025 as part of security measures 14. The Auror platform operates across multiple markets including the UK, US, Canada, Australia, and New Zealand 12.

STACKIT is Schwarz Group’s sovereign cloud platform with data centers exclusively in Germany and Austria 15. STACKIT explicitly positions itself as a European alternative to AWS, Azure, and Google, designed to avoid US CLOUD Act jurisdiction 16. STACKIT partnered with Google in November 2024 to offer sovereign Google Workspace with client-side encryption; approximately 575,000 Schwarz Group employees migrated to this platform 1718.

No public evidence identified for direct licensing, subscription, or integration relationships between Lidl or Schwarz Group and Check Point, Wiz, SentinelOne, CyberArk, Nice, Verint, Claroty, Palo Alto Networks, Trigo, BriefCam, AnyVision/Oosto, or Trax.

Surveillance, Biometrics & Retail Technology

Lidl GB’s customer privacy notice explicitly states that no facial recognition technologies are used 13. Cameras using non-scan detection technologies are active only at checkouts, and all facial images are pixelated 13. Lidl GB publicly states it does NOT use facial recognition for loss prevention or any other retail function 1311.

No public evidence identified of Israeli-origin facial recognition, biometric identification, behavioural analytics, or gait analysis technology deployed via Auror or any other third-party platform at Lidl. No evidence identified of Trigo, BriefCam, AnyVision/Oosto, or Trax products being used in Lidl stores. No public evidence identified of Israeli-origin predictive policing, sentiment analysis, social media monitoring, or workforce surveillance tools used by Lidl or Schwarz Group.

Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

No public evidence identified of Lidl or Schwarz Group operating, leasing, or co-locating data centre infrastructure within Israel. STACKIT data centers are confirmed exclusively in Germany and Austria 15. No public evidence identified of Lidl or Schwarz Group participating in Project Nimbus or comparable state-backed digital infrastructure programmes. STACKIT is designed for commercial enterprise use; no documented Israeli government cloud contracts have been identified.

STACKIT explicitly markets data sovereignty positioning with Made in Germany compliance and GDPR adherence 15. STACKIT is designed to avoid US CLOUD Act jurisdiction with no equivalent Israeli legal regime exposure documented 16. No services are documented as being explicitly marketed or contracted to ensure digital sovereignty for Israeli state institutions or military bodies. Schwarz Group partnered with Google in November 2024 for sovereign Google Workspace hosted on STACKIT data centers in Germany and Austria 1718. Client-side encryption ensures Google cannot access data, and data residency is confirmed in the EU only 17.

Defence, Intelligence & Security Sector Technology Relationships

The XM Cyber acquisition establishes a material relationship between Schwarz Group and a company with intelligence-community leadership history 12. XM Cyber was co-founded by former Mossad Director Tamir Pardo, who served as company President 2. The acquisition in November 2021 for $700 million creates a direct relationship between Schwarz Group and Israeli-origin cybersecurity technology with intelligence-community founder ties 12.

No public evidence identified of direct contracts, partnerships, or service agreements between Lidl or Schwarz Group and Israeli Ministry of Defence, IDF, intelligence agencies, or state security bodies. No public evidence identified of commercially available Lidl or Schwarz Group technology being publicly reported, confirmed by official sources, or documented by researchers as deployed for military, intelligence, or law enforcement surveillance applications within Israel or occupied territories. No public evidence identified of Schwarz Group developing, selling, licensing, or maintaining offensive cyber capabilities, zero-day exploit tools, or digital weapons systems.

AI, Algorithmic & Autonomous Systems

No public evidence identified of Lidl or Schwarz Group providing AI, ML, computer vision, or autonomous decision-support systems to Israeli state, military, or security bodies. No public evidence identified of Lidl or Schwarz Group AI models or platforms being trained on, or provided access to, civilian population data, intercepted communications, or surveillance-derived datasets originating from Israel or occupied territories. No public evidence identified of Lidl or Schwarz Group providing autonomous target generation, automated threat detection, or autonomous tracking systems to Israeli military or security forces.

Technology Ecosystem & R&D Footprint

No public evidence identified of Schwarz Group maintaining research and development facilities, engineering offices, innovation labs, or accelerator programmes within Israel. XM Cyber continues operating from Herzliya, Israel (acquired November 2021), with no evidence of R&D relocation or closure post-acquisition 2. XM Cyber was acquired by Schwarz Group in November 2021 for $700 million and specializes in breach and attack simulation 12. The company is headquartered in Herzliya, Israel 2.

Dieter Schwarz family office investment vehicle (ZFHN/D11Z.Ventures) invested approximately $6 million in Inspekto in 2018, an Israeli startup developing fault detection technology for industrial production equipment 78. No public evidence identified of significant patent portfolios, licensing agreements, or co-development arrangements between Lidl or Schwarz Group and Israeli-domiciled entities or research institutions such as Technion, Hebrew University, or Weizmann Institute.

Civil Society Scrutiny & Regulatory History

Neither Lidl nor Schwarz Group is listed in the UN OHCHR Business and Human Rights database of companies involved in settlement activities 19. The database contains over 158 companies involved in settlement activity; neither entity appears in current iterations 19. The Special Rapporteur’s July 2025 report on From economy of occupation to economy of genocide (A/HRC/59/23) covers surveillance, AI, cloud, and Project Nimbus 20. The report names AWS, Google, Microsoft, Palantir, and NSO Group as relevant entities 20. No specific mention of Lidl or Schwarz Group was found in the report 20.

Who Profits documented that Mehadrin Group, an Israeli agricultural export company, operates orchards in Israeli settlements in the occupied West Bank (Jordan Valley: Beka’ot, Tomer, Na’aran, Netiv Hagdud) and Golan Heights (Ramot) and exports produce to European retailers including Lidl and Aldi 2122. Who Profits documented PreZero products present in the Ariel industrial zone in the occupied West Bank in March 2022 2324. PreZero is Schwarz Group’s environmental services division 2324.

The Irish Palestine Solidarity Campaign has conducted BDS campaigns against Lidl, specifically targeting Lupilu baby products manufactured in Israel in Ashdod and Caesarea 2526. Irish activists documented a protest at a Dublin Lidl store in 2024 27. BDS campaigns in Ireland have reported some success in removing Israeli-made products from Irish Lidl stores 2526. The BankTrack Don’t Buy Into Occupation 2025 report includes 104 companies but Lidl and Schwarz Group are not specifically listed as direct targets 28.

No regulatory inquiries, legal challenges, export control actions, or sanctions-related investigations were found specifically targeting Lidl’s technology sales or services to Israeli state entities. No GDPR fines against Lidl were documented in the 2023-2024 period 29. Lidl operates in 32 countries but does not have stores in Israel 3031. No evidence identified of Lidl stores, franchises, or authorized resellers operating in West Bank, East Jerusalem, or Golan Heights settlements 31.

End Notes

Footnotes

  1. https://www.timesofisrael.com/german-firm-acquires-ex-mossad-chiefs-cybersecurity-startup-for-700m ↩ ↩2 ↩3 ↩4

  2. https://www.calcalistech.com/ctech/articles/0,7340,L-3923098,00.html ↩ ↩2 ↩3 ↩4 ↩5 ↩6 ↩7 ↩8 ↩9 ↩10 ↩11

  3. https://www.calcalistech.com/ctechnews/article/rj59cylu5 ↩

  4. https://xmcyber.com/press-release/rafael-sets-up-first-of-its-kind-israeli-cyber-consortium-with-leading-cyber-solution-partners/ (XM Cyber listed as a member; “in cooperation with the Israel National Cyber Directorate”) ↩

  5. https://www.timesofisrael.com/defense-contractor-rafael-sets-up-consortium-to-tackle-industrial-hacks/ ↩

  6. https://en.globes.co.il/en/article-former-mossad-chiefs-cybersecurity-company-to-operate-in-gulf-1001383248 (consortium pitched at Gulf/Dubai critical infrastructure post-Abraham-Accords) ↩

  7. https://www.hopohopo.io/investors/zukunftsfonds-heilbronn-zfhn ↩ ↩2 ↩3

  8. https://www.ishitech.co.il/0518ar9.htm ↩ ↩2

  9. https://en.globes.co.il/en/article-german-billionaire-seeks-israeli-high-tech-investments-1001238937 ↩

  10. https://en.wikipedia.org/wiki/Schwarz_Digits ↩ ↩2 ↩3 ↩4

  11. https://www.retail-systems.com/rs/Lidl_Trials_VAR_Style_Self_Service_Checkouts_To_Combat_Shoplifting.php ↩ ↩2

  12. https://losspreventionmedia.com/auror-expands-into-the-united-kingdom ↩ ↩2

  13. https://www.lidl.co.uk/c/customer-privacy-notice/s10022952 ↩ ↩2 ↩3 ↩4

  14. https://www.retaildive.com/news/shrink-theft-self-checkout-grocery-retail-food/712527 ↩

  15. https://stackit.com/en/why-stackit/company-profile ↩ ↩2 ↩3

  16. https://stackit.com/en/learn/knowledge/cloud-act ↩ ↩2

  17. https://www.techzine.eu/news/infrastructure/126325/lidl-sister-company-hosts-google-workspace-within-eu ↩ ↩2 ↩3

  18. https://gruppe.schwarz/en/press/archive/2024/companies-of-schwarz-and-google-to-sign-partnership ↩ ↩2

  19. https://www.ohchr.org/en/business/bhr-database ↩ ↩2

  20. https://www.ohchr.org/en/documents/country-reports/ahrc5923-economy-occupation-economy-genocide-report-special-rapporteur ↩ ↩2 ↩3

  21. https://www.whoprofits.org/companies/company/4108 ↩

  22. https://www.whoprofits.org/writable/uploads/old/uploads/2018/06/old/made_in_israel_web_final.pdf ↩

  23. https://www.whoprofits.org/companies/company/7365?prezero= ↩ ↩2

  24. https://www.whoprofits.org/companies/company/7365 ↩ ↩2

  25. https://www.ipsc.ie/category/lidl ↩ ↩2

  26. https://my.uplift.ie/petitions/lidl-stop-selling-israeli-goods ↩ ↩2

  27. https://www.facebook.com/trtworld/videos/a-group-of-irish-activists-have-stormed-a-lidl-supermarket-in-dublin-to-add-boyc/388383973980702 ↩

  28. https://www.banktrack.org/event/report_launch_dont_buy_into_occupation_2025 ↩

  29. https://www.hunton.com/privacy-and-cybersecurity-law-blog/german-data-protection-authority-issues-e-36000-fine-against-lidl-for-collection-of-employee-health-data ↩

  30. https://www.quora.com/Are-there-Lidl-in-Tel-Aviv ↩

  31. https://en.wikipedia.org/wiki/Lidl ↩ ↩2