Digital Audit: H&M

H&M Group - Digital Audit: Domain Findings

Enterprise Technology Stack & Vendor Relationships

A widely-circulated claim describes H&M’s global network as secured by a “triad” of Israeli-origin cybersecurity vendors - Check Point Software Technologies (firewalls), Wiz (cloud security) and SentinelOne (endpoint protection) - sometimes styled as a “Unit 8200 Stack.” No independent primary source corroborates this claim: no vendor case study, H&M press release, careers-page tooling disclosure, or trade-press reporting was identified confirming a licensing, subscription, or integration relationship between H&M and Check Point, Wiz, SentinelOne, CyberArk, NICE, Verint, or Claroty ¹². No public evidence identified substantiating the “triad”/“Unit 8200 Stack” characterization as fact. H&M Group’s own careers/cybersecurity communications do not disclose specific vendor names ².

By contrast, H&M Group’s relationship with Google Cloud (a US-headquartered, non-Israeli vendor) is independently documented: a strategic partnership announced around June 2022 to build an enterprise “data backbone,” data mesh, and AI/ML capabilities spanning store, online, brand and supplier data, continuing an earlier Google Cloud engagement ³⁴⁵. H&M Group also uses Microsoft 365 and Power Platform at scale, with roughly 1,500 internally built applications, over 30,000 licensed users, and a dedicated governance function (“Center of Enablement”) ⁶⁷. H&M’s “Laboratory” innovation unit collaborated with Microsoft, AKQA and Turnpike on the Mitte Garten tech-led retail concept in Berlin ⁸. H&M Group Ventures became a strategic investor in Avassa, a Stockholm-based (non-Israeli) edge-computing/application-management platform used across H&M’s in-store IT for offline resilience, as of October 2024 ⁹¹⁰. Google Cloud and Microsoft relationships appear embedded in core enterprise data, AI, and internal application infrastructure rather than peripheral tooling ³⁴⁵⁶⁷. No public evidence identified of Accenture, Capgemini, Deloitte, TCS, Cognizant, or comparable systems integrators engaged by H&M Group for major technology programmes, nor of any integrator recommending or deploying Israeli-origin technology on H&M’s behalf.

Surveillance, Biometrics & Retail Technology

No public evidence identified of H&M procurement or deployment of facial-recognition or computer-vision platforms from Israeli-origin vendors such as Trigo, BriefCam, AnyVision/Oosto, or Trax. No public evidence identified of an Israeli-vendor or facial-recognition nexus in any H&M loss-prevention technology pilot. No public evidence identified of predictive-analytics or workforce-surveillance tooling of Israeli origin in use at H&M. No public evidence identified of Israeli-origin surveillance or biometric technology reaching H&M indirectly through bundled platforms or managed services.

Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

No public evidence identified that H&M operates, leases, or co-locates data-centre infrastructure within Israel. H&M is not a party to Project Nimbus, the roughly $1.2bn joint Google–Amazon Web Services contract with the Israeli government under which Google and AWS built local cloud regions and data centres in Israel from 2021 onward ^11121314; this is an entirely separate arrangement from H&M’s commercial Google Cloud retail-data partnership ³⁴. Both of H&M’s principal cloud/software partners - Google, and Amazon-adjacent infrastructure via the AWS ecosystem - are the same corporate entities that deliver Project Nimbus to Israeli state and military bodies ¹¹¹²¹³, a vendor-level overlap noted here as context rather than as evidence that H&M data transits Nimbus-linked infrastructure. No public evidence identified indicating that H&M’s Google Cloud workloads are hosted in Google’s Israel cloud region specifically, as opposed to other regions ¹³. No public evidence identified that H&M provides data-sovereignty or resilience services to Israeli state or military bodies; in the cloud relationships documented, H&M functions as a technology customer, not a technology provider to Israeli state entities ³⁴⁵.

Defence, Intelligence & Security Sector Technology Relationships

No public evidence identified of any contract or service agreement between H&M and Israel’s Ministry of Defence, the IDF, or Israeli intelligence agencies. No public evidence identified of H&M developing or supplying dual-use technology to any government or military body, consistent with H&M’s core business model as a retail apparel company rather than a technology provider to state security bodies. No public evidence identified of any H&M involvement in offensive cyber or weapons-related technology.

AI, Algorithmic & Autonomous Systems

No public evidence identified of H&M providing AI or machine-learning systems to Israeli state or military bodies. H&M’s identified AI/ML activity is limited to internal retail and supply-chain analytics built on its Google Cloud partnership, a consumption relationship rather than provision to any state or military body ³⁴⁵. No public evidence identified that any H&M AI system uses training data sourced from Israeli or Occupied Palestinian Territory surveillance systems. No public evidence identified of H&M involvement in autonomous targeting or tracking systems.

Technology Ecosystem & R&D Footprint

No public evidence identified of any H&M-operated research and development facility, engineering office, or innovation lab located in Israel. H&M Group Ventures maintains a portfolio of roughly 35 companies representing over 3 billion SEK in investment since 2015, concentrated in sustainable fashion, retail SaaS, and climate technology (including Voyado, Heirloom, and Rondo Energy), with nine companies added to the portfolio in 2024 ¹⁵¹⁶. No public evidence identified of any Israeli-domiciled company within H&M Group Ventures’ portfolio. No public evidence identified of H&M patents, licensing, or research collaborations with Israeli academic institutions such as Technion, Hebrew University, or the Weizmann Institute.

Civil Society Scrutiny & Regulatory History

H&M entered the Israeli market via a franchise agreement announced in 2008, with its first store opening in March 2010 ¹⁷¹⁸¹⁹. This market entry has been the subject of sustained, technology-agnostic BDS/boycott campaigns since 2008–2010, including calls to boycott H&M over its Jerusalem-area retail presence ²⁰²¹²², and continued civil-society scrutiny through coalition reporting such as the “Don’t Buy into Occupation Report 2024” ²³. These campaigns concern H&M’s general commercial presence in Israel rather than any specific technology provision; no technology-specific boycott campaign against H&M was identified. H&M temporarily closed its roughly 24 Israeli stores around 7–10 October 2023 following the Hamas attacks, reopening within approximately a week ²⁴²⁵²⁶; H&M had launched a dedicated Israeli e-commerce website in September 2022 ²⁷²⁸.

H&M does not appear to operate stores within West Bank or East Jerusalem settlements, a distinction Who Profits’ own comparative company data draws between H&M and other fashion retailers it tracks as having settlement operations, such as Fox Group (Fox-Wizel) and Castro Model ²⁹. Whether H&M appears in the OHCHR’s HRC 31/36 settlement-business database update or in Special Rapporteur Francesca Albanese’s A/HRC/59/23 report could not be confirmed with certainty, as text extraction from both documents was degraded; this should be treated as unresolved rather than a clean negative finding ³⁰³¹. Delta Galil Industries is cited by a secondary source as an H&M supplier operating a warehouse in the Barkan Industrial Zone, a West Bank settlement, and is independently documented by Who Profits as having settlement-linked operations ³²³³; however, no primary source - neither Delta Galil’s own disclosures, H&M’s supplier-transparency materials, nor Who Profits’ own data - was found confirming H&M as a Delta Galil customer, so this specific supplier link remains unverified. Similarly, secondary commentary asserts that H&M’s online store delivers to Ma’ale Adumim and Pisgat Ze’ev, both located across the Green Line ³³²⁷²⁸, but no independent primary source - H&M’s own delivery-zone documentation, an independent news investigation, or an NGO field-verified delivery test - was found substantiating this specific claim, so it remains unverified rather than confirmed.

No public evidence identified of any regulatory inquiry, export-control action, or sanctions investigation involving H&M’s technology sales or services to Israeli state entities. On governance, H&M’s nomination committee proposed Klas Balkow as a new board member in March 2025; Balkow holds an external board assignment on a Swedish Armed Forces oversight council, a defense-adjacent governance role that is not Israel-specific ³⁴³⁵. No public evidence identified of any H&M controlling principal - including members of the Persson family or Ramsbury Invest - holding equity stakes, board roles, or personal investments in Israeli surveillance, cyber, AI, SIGINT, or military-technology firms.

End Notes