Digital Domain Audit: Christian Dior (Dior)

Target: Christian Dior Couture (luxury fashion/fragrance house; brand of LVMH) Domain: Digital (Digital / Technology) Date: June 2026 Scope: Dior the fashion house’s own digital/data/cyber/surveillance/AI conduct re Israel. LVMH group-level tech is attributed at the parent-group level.

Scope note. This audit assesses Christian Dior Couture and Parfums Christian Dior (the “Dior” maison) and its own digital, data, cyber, surveillance and AI conduct, with a focus on any Israel nexus. The parent LVMH group’s enterprise technology programme (e.g. the LVMH–Google Cloud partnership) and the Arnault family holding / Aglaé Ventures investment activity are separate legal and operational layers and are treated below only as explicitly flagged parent/holding-level context. US- and EU-domiciled vendors are treated as such even where founders have Israeli backgrounds; only the vendor’s corporate domicile and the Dior-specific contracting relationship are assessed as in-scope.

Enterprise Technology Stack & Vendor Relationships

Dior’s client data is managed through a third-party Salesforce CRM environment, which was confirmed as the platform compromised in the 2025 breach campaign described below.¹² Dior had been operating the affected customer-management SaaS system since 2020.³

For AR beauty and virtual try-on, Parfums Christian Dior contracts Perfect Corp (a beauty-tech firm headquartered in New Taipei City, Taiwan, with a New York presence; founded 2014 by Alice Chang), a relationship running since 2020 and spanning the Dior website, retailer sites, Google platforms, WeChat and the Taobao Mini Program.⁴⁵ A 2022–2023 live-consultation offering paired Perfect Corp’s AR try-on with live-shopping vendor Bambuser (a 2021 LVMH Innovation Award winner).⁴⁶ Dior’s eyewear “Try Online” virtual try-on used facial-recognition technology supplied by FittingBox, a virtual-fitting company headquartered in Toulouse, France (with a US base in Miami).⁷⁸ None of Perfect Corp, Bambuser or FittingBox is Israeli-domiciled.

The most material Israel-nexus vendor relationship in Dior’s own stack is with Kahoona, an Israeli AI personalisation startup. Kahoona was founded by Technion/MIT graduates Gal Rapoport, Alon Ashkenasi and Ohad Tzur, operates its R&D centre in Tel Aviv (with a US sales base in San Diego), and is listed as an Israeli company on Startup Nation Central’s Finder.⁹¹⁰ Kahoona collaborated directly with the Dior team through LVMH’s startup programme; its CEO described working “together as real partners” with Dior, and Christian Dior Couture was awarded the Best Business Prize for its collaboration with Kahoona at the 2025 Viva Technology / 9th LVMH Innovation Award.⁹¹¹ Kahoona’s platform generates anonymised, cookieless real-time user profiles (“digital body language”) to personalise interactions for anonymous website visitors.⁹¹¹ This is a Dior-specific contracting relationship with an Israeli-domiciled technology vendor, not merely a group-level arrangement.

In Israel itself, the Dior e-commerce storefront (diorboutique-il.com) is operated by DRRR Ltd, the exclusive Israeli distributor of Parfums Christian Dior, and runs on the Shopify platform.¹²¹³ This is a local-distributor storefront rather than Christian Dior Couture’s own corporate e-commerce, a distinction relevant to attributing data-processing conduct.

Parent-group context: At the LVMH group level, LVMH and Google Cloud formed a strategic AI/cloud partnership (announced June 2021), under which cloud-based AI underpins group operations and LVMH modernised IT infrastructure on Google Cloud.¹⁴ This is a parent-group arrangement, not a Dior-maison-specific contract, and is attributed accordingly.

Surveillance, Biometrics & Retail Technology

Dior operated an eyewear virtual try-on tool (“Try Online” on dior.com) that, per a class-action complaint, used FittingBox facial-recognition software to scan users’ facial geometry to overlay eyewear.⁷ An Illinois suit filed 30 August 2022 alleged Dior collected this biometric data without the knowledge, consent, written authorisation or published retention policy required by the Illinois Biometric Information Privacy Act (BIPA).⁷ The suit was dismissed on 10 February 2023, the court ruling Dior’s conduct fell within BIPA’s healthcare exemption (treating non-prescription sunglasses as Class I medical devices).⁷ This establishes that Dior’s own consumer-facing tools captured biometric facial-geometry data; the supplying vendor (FittingBox) is French, not Israeli.

Dior states it uses video surveillance in its stores to detect security/safety incidents, shoplifting and other illegal activity.¹⁵ For in-boutique retail technology, Dior is documented using NFC authentication tags on products and participates in luxury-sector clienteling (orchestrating boutique, web and aftersales touchpoints into unified customer profiles).¹⁶

On in-store facial-recognition or biometric customer-tracking specifically by Dior in Israel or anywhere: No public evidence identified. On any Israeli-origin biometric, surveillance or video-analytics vendor in Dior’s own retail-technology stack: No public evidence identified.

Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

On Dior maison-specific cloud arrangements: the breached client data sat in a third-party Salesforce environment.¹² At the LVMH group level (attributed at parent-group level), infrastructure runs partly on Google Cloud.¹⁴

On any Dior-specific data-residency arrangement, data centre, or sovereign/government-cloud participation in Israel: No public evidence identified. The Israeli Dior storefront is a Shopify-hosted distributor site (DRRR Ltd), with no public indication of Dior-Couture-controlled data residency in Israel.¹²¹³ Dior is not publicly identified as a participant in Israel’s “Nimbus” government cloud programme or any equivalent.

Defence, Intelligence & Security Sector Technology Relationships

On any relationship between Dior (the fashion house) and defence, military, intelligence or security-sector technology - Israeli or otherwise: No public evidence identified. Dior is a luxury fashion/fragrance house with no identified defence or intelligence technology supply, procurement or partnership in the public record.

Parent/holding-level context: The Arnault family / Aglaé Ventures investment vehicle (a holding-level entity, not Dior the maison) participated in funding for the Israeli cloud-security firm Wiz.¹⁷ This is an Arnault holding-company investment, distinct from Christian Dior Couture’s own operations, and is recorded here as context, attributed to the Arnault holding level.

AI, Algorithmic & Autonomous Systems

Dior deploys AI across personalisation, virtual try-on, demand forecasting and trend prediction, building “detailed, dynamic customer profiles” from browsing behaviour, purchase history and social-media engagement to drive tailored recommendations.¹⁸¹⁹ Dior’s AI posture is described as a “dual-engine” of the maison’s own implementations plus the LVMH technology ecosystem.¹⁹

The AI/algorithmic system with the clearest Israel nexus is the Kahoona personalisation engine (Israeli vendor; Tel Aviv R&D), which Dior used to profile anonymous website visitors’ “digital body language” in real time - an award-winning Dior–Kahoona collaboration (2025 LVMH Innovation Award, Best Business Prize).⁹¹¹ AR/AI beauty personalisation is also delivered via Taiwan’s Perfect Corp.⁴⁵

On any autonomous systems or AI deployed by Dior in a military, security or occupation context: No public evidence identified.

Technology Ecosystem & R&D Footprint

Dior engages emerging technology vendors primarily through La Maison des Startups LVMH, the group accelerator, where Dior has piloted external startups including the Israeli firm Kahoona (personalisation) and the London-based 3D/AR firm Threedium (3D product visualisation; founded 2017, London-HQ, non-Israeli founders).⁹¹¹²⁰ Of Dior’s publicly documented startup/tech collaborations, Kahoona is the one with Israeli R&D and corporate roots; Perfect Corp (Taiwan), Bambuser, FittingBox (France) and Threedium (UK) are not Israeli.⁴⁷⁹²⁰

On a Dior-operated R&D centre, innovation lab or engineering presence physically located in Israel: No public evidence identified. Dior’s documented Israeli footprint is commercial retail (Tel Aviv and Jerusalem boutiques, the latter at Mamilla Mall) operated with local partners/distributors, not technology R&D.²¹¹²

Civil Society Scrutiny & Regulatory History

2025 Salesforce/ShinyHunters breach. Dior was among numerous LVMH and luxury brands hit in a 2025 social-engineering campaign against Salesforce environments, attributed by Google’s Threat Intelligence Group to the actor it tracks as UNC6040, widely linked to the ShinyHunters extortion group.¹²² At Dior, an unauthorised party accessed a client database; the intrusion occurred 26 January 2025, was discovered 7 May 2025, and US customer notifications were sent from mid-July 2025, with separate notices in South Korea and China.²³ Exposed data included names, contact details, mailing addresses, dates of birth, purchase history and, in some cases, government-issued ID numbers; Dior said no payment/bank data was in the affected database.²³ Over 100,000 US records were reported, and Korean regulators put the figure at roughly 1.95 million customers there.³²³

South Korea PIPC enforcement. South Korea’s Personal Information Protection Commission fined Dior approximately US$9.4 million (announced 13 February 2026) for security failures - no access allow-lists, no bulk-download restrictions, no access-log inspection - and for breaching notification rules, including failure to report to the Korea Internet & Security Agency (KISA) as required.²³ The action was part of a combined ~US$25 million in fines across Louis Vuitton, Dior and Tiffany.²³²⁴

US litigation. Data-breach class actions tied to the Salesforce hack were reported, with at least some claims against Dior dismissed.²⁵

BIPA biometric suit. As noted, the Illinois BIPA suit over Dior’s FittingBox-powered eyewear try-on was filed in August 2022 and dismissed in February 2023.⁷

Israel-related brand scrutiny. In November 2023 Dior faced pro-Palestinian boycott calls after selecting Israeli model May Tager for a campaign; coverage noted the framing that Dior “replaced” Bella Hadid was inaccurate, as Hadid’s Dior Makeup contract had ended in 2022.²⁶ This is reputational/brand-campaign scrutiny rather than a digital/technology matter, and is more properly assessed in the Political domain; it is noted here only for completeness of the public-scrutiny record.

On civil-society or regulatory scrutiny of Dior’s digital/technology conduct specifically tied to Israel (e.g. surveillance tech, Israeli-vendor data flows): No public evidence identified beyond the Kahoona vendor relationship documented above, which has not itself been the subject of public scrutiny.

End Notes