Digital Audit: Costco Wholesale Corporation

Audit Phase: Digital (Digital / Technology Forensics) Subject Entity: Costco Wholesale Corporation (NASDAQ: COST) Headquarters: 999 Lake Drive, Issaquah, Washington 98027, United States Audit Date: June 2026 Evidence Base: Published corporate disclosures, SEC filings, the company privacy policy, vendor and partner press releases, trade and technology press, litigation records, and NGO research. All factual claims are drawn from publicly available sources cited in the End Notes.

Scope and directionality note: Digital assesses the digital/technology nexus to Israel. The serious case is the provision of surveillance, digital, data, or cyber technology to the Israeli state, military, or security services. The reverse direction - Costco procuring technology from Israeli-origin vendors, or making an Israeli-developed product available to its members or workforce - is a customer/distribution relationship and is recorded explicitly as such, weighted far lower than provision. No transitive guilt is imputed: an Israeli vendor’s other clients, its founders’ military backgrounds, or a parent group’s separate activities are not attributed to Costco. US- and UK-entity relationships (e.g. Microsoft, Travelport) are not Israeli-origin and are noted only for completeness. Any cyberattack suffered by Costco is recorded as an event done to the company, not as provision.

Enterprise Technology Stack & Vendor Relationships

Strategic Technology Partnerships (Direction: Costco as customer)

Costco’s principal publicly documented enterprise/consumer technology relationship in the period reviewed is with Travelport, a United Kingdom-headquartered travel-technology company. On 18 February 2025 Costco Travel signed a multi-year agreement to adopt the Travelport+ platform, including Travelport’s “AI-powered Content Curation Layer” for trip search and its “Travelport Insights” data product.¹² Travelport is headquartered in the United Kingdom and operates in more than 165 countries; the press materials disclose no Israeli connection.¹ This is a Costco-as-customer relationship with a non-Israeli vendor and is recorded for completeness only.

Third-party technographic profiling lists Costco’s enterprise/e-commerce stack as including Salesforce Commerce Cloud (US-origin), VMware Cloud Foundation, and VMware vSphere (US-origin).³ No public evidence was identified that any of these named platforms is Israeli-origin or routes Costco technology, data, or services to any Israeli entity.

Israeli-Origin Technology Vendors in the Costco Stack (Direction: Costco as customer)

No public evidence was independently identified confirming a named licensing, subscription, or integration relationship between Costco and any Israeli-origin enterprise software vendor for its core retail, e-commerce, or ERP systems. (The one Israeli-developed product reaching Costco’s orbit - Hello Heart, via the Costco-part-owned PBM Navitus - is addressed under “AI, Algorithmic & Autonomous Systems,” as it is a digital-health distribution pathway, not a core-stack procurement.)

Israeli-Origin Cybersecurity Vendors

No public evidence was independently identified confirming that Costco holds a licensing, subscription, or integration relationship with any Israeli-origin cybersecurity vendor - including Check Point, Wiz, CyberArk, SentinelOne, Palo Alto Networks, Claroty, Verint, or NICE Systems. These are documented Israeli-founded or Israeli-origin firms, several with Unit 8200-veteran founders, and their products are widely deployed across US Fortune 500 retail and financial-services enterprises; but vendor customer-story repositories reviewed did not surface a Costco case study, and no Costco disclosure names any of them.⁴ No public evidence identified of a Costco deployment of any specific Israeli-origin security product.

Procurement Transparency Constraints

Costco’s SEC filings (Form 10-K) disclose cybersecurity and information-technology risk generically and reference reliance on third-party service providers, but do not name specific security or IT vendors.⁵ This is standard practice for large US retailers. Vendor relationships below the level of named, publicly announced partnerships are not in the public domain, and the full security/IT vendor stack is undisclosed. This is the principal evidence gap in this domain.

Surveillance, Biometrics & Retail Technology

Membership Verification Kiosks - Card Scanning (Not Facial Recognition)

Beginning with pilots in approximately January 2024 (following an earlier self-checkout photo-verification step in June 2023), Costco rolled out membership-card-scanning kiosks at warehouse entrances. A member scans the barcode on a physical card or the QR code on the digital Costco app; the kiosk then displays the cardholder’s stored photo on a screen for a Costco employee to compare visually against the person presenting the card.⁶⁷ Reporting and Costco’s own description indicate the system performs card-based photo display for human comparison and does not use facial-recognition technology.⁷ No hardware or software vendor for the kiosk system has been publicly disclosed by Costco, and no Israeli-origin vendor has been identified in connection with it. No public evidence identified linking this deployment to Israeli-origin technology.

Automatic Licence Plate Recognition (ALPR)

Costco’s published privacy policy discloses that the company uses Automatic Licence Plate Recognition (ALPR) technology at some of its properties to collect vehicle information for security, loss prevention, incident investigation, and traffic management at gas pumps and car washes, and states that access to ALPR data is restricted to personnel with a need to know.⁸ Costco is named alongside Lowe’s, Home Depot, Target, and Walmart in trade reporting on retailer ALPR use; the same reporting associates some retail ALPR deployments with the US vendor Flock Safety.⁹ No public source identifies the specific ALPR vendor used by Costco, and no Israeli-origin ALPR vendor (e.g. Verint) has been linked to Costco. No public evidence identified connecting Costco’s ALPR use to Israeli-origin vendors.

Facial Recognition & Computer Vision - Israeli-Origin Vendors

No public evidence was identified that Costco deploys facial-recognition, biometric, gait-analysis, or in-store behavioural-analytics technology of Israeli origin (e.g. Oosto/AnyVision, BriefCam, Trigo, Trax). No public evidence identified.

Scan & Go / Frictionless Checkout

No public evidence was identified naming any technology vendor - Israeli-origin or otherwise - underpinning Costco self-checkout or scan-and-go capability. No public evidence identified.

No public evidence was identified of Costco using Israeli-origin predictive-analytics, sentiment-analysis, social-media-monitoring, or workforce-surveillance tools. No public evidence identified.

Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

Data Centre Operations in Israel

No public evidence was identified that Costco operates, leases, or co-locates data-centre infrastructure within Israel. Costco operates no warehouses, e-commerce storefront, or subsidiary in Israel that would require Israeli data residency.¹⁰ No public evidence identified.

Project Nimbus & Israeli State Cloud Infrastructure

Not applicable. Project Nimbus is the Israeli-government cloud contract awarded to Google Cloud and Amazon Web Services; Costco is neither a participant nor a sub-provider. Costco’s commercial use of mainstream US cloud platforms (such as Salesforce-hosted and VMware-based infrastructure)³ does not constitute any documented relationship with Project Nimbus: commercial cloud workloads and Israeli-government workloads run in separate regions under distinct contractual frameworks. No public evidence identified of any Costco involvement in any Israeli state-backed digital-infrastructure programme.

Data-Sovereignty or Resilience Services to Israeli State Institutions

No public evidence identified. Costco is a retail and membership-warehouse corporation, not a cloud- or technology-services provider to any state body, Israeli or otherwise.

Defence, Intelligence & Security Sector Technology Relationships

Military & Intelligence Contracts

No public evidence was identified of any contract, partnership, or service agreement between Costco and the Israeli Ministry of Defence, the Israel Defense Forces (IDF), or Israeli intelligence agencies (including Unit 8200-linked commercial entities in any institutional capacity). Costco is a retail business and does not publicly operate in the defence-technology or security-services sector. No public evidence identified.

Provision of Technology / Data to the Israeli State or Military

No public evidence was identified of Costco providing surveillance technology, data, software, cloud capacity, or digital services to the Israeli state, military, or security services. This is the directionally serious Digital case, and no qualifying evidence of it was found. No public evidence identified.

Dual-Use Technology Provision

No public evidence was identified of Costco commercial technology, products, or services being reported or confirmed as deployed for military, intelligence, or law-enforcement surveillance applications in Israel or the Occupied Palestinian Territories. No public evidence identified.

Offensive Cyber Capability

No public evidence identified. Costco does not develop, license, or sell offensive cyber capability, exploit tooling, or digital weapons; this is outside its business domain.

Cyber Incidents Suffered By Costco (Direction: done to the company)

For factual digital context only, and recorded as events done to Costco rather than any provision: in November 2021 Costco disclosed that a payment-card skimming device had been discovered on a single in-store payment terminal, exposing magnetic-stripe data of a limited number of customers, with affected customers offered identity-protection services.¹¹ Separately, Costco’s photo-printing service was reported among retailers affected by a third-party photo-vendor breach.¹¹ Neither incident has any nexus to the provision of technology to Israel.

AI, Algorithmic & Autonomous Systems

AI/ML Provision to Israeli State Bodies

No public evidence identified. No public evidence was identified of Costco providing AI capability, model access, training data, or inference services to any Israeli state, military, or security body.

Internal & Member-Facing AI - Vendor Origin

Costco’s documented AI/ML deployments are internal and member-facing: a machine-learning bakery-demand-forecasting model in use since approximately 2018 (reported via SAP documentation), and the Travelport “AI-powered Content Curation Layer” for Costco Travel search adopted in February 2025.¹¹² Costco’s leadership has publicly characterised the company as in the “early innings” of AI adoption.¹² No Israeli-origin AI vendor was identified among Costco’s named AI deployments.

Hello Heart (Israeli-origin digital health, via Navitus) - Distribution Pathway

Navitus Health Solutions is a pharmacy benefit manager (PBM) co-owned by Costco and SSM Health.¹³ On 22–23 September 2025, Navitus and Hello Heart announced a partnership making Hello Heart’s digital heart-health platform available to Navitus’s clients (reported as nearly 800 employers and health plans, covering over 18 million lives).¹³¹⁴ Hello Heart Ltd. is an Israeli-founded digital-health company, founded in 2013, led by CEO and co-founder Maayan Cohen (publicly described as a former Israeli Army tank commander), with its operations led from Tel Aviv; it provides an FDA-cleared connected blood-pressure monitor paired with an AI-driven cardiovascular-coaching app, and maintains a US presence in Menlo Park, California.¹⁵¹⁶ The directionality here is distribution/customer-facing: an Israeli-developed commercial product being made available to members of a Costco-part-owned PBM (and, by extension, potentially to Costco’s own workforce if covered) - not Costco providing technology, data, or services to Israel.¹³¹⁴ Neither announcement mentions Costco’s ownership stake directly; the Costco-Navitus ownership link is documented separately in Navitus and trade disclosures.¹³

Training Data & Model Development Involving Israeli Population Data

No public evidence was identified of Costco contributing to, commissioning, or benefiting from AI model development involving Israeli population datasets, intercepted communications, or surveillance-derived data. No public evidence identified.

Autonomous Systems & Lethality

No public evidence identified. The development or deployment of autonomous lethal systems is not within Costco’s business domain.

Technology Ecosystem & R&D Footprint

Israeli R&D Facilities

No public evidence was identified that Costco operates any R&D facility, engineering office, innovation lab, or accelerator programme within Israel. Costco operates no warehouses or corporate offices in Israel.¹⁰ No public evidence identified.

Acquisitions & Investments in Israeli Technology Companies

No public evidence was identified of Costco acquiring, or taking a corporate-venture stake in, any Israeli technology company, or investing in any Israel-focused venture fund. (Costco’s ownership of Navitus - which separately partnered with the Israeli-founded Hello Heart as a distribution channel - is a US-domiciled PBM holding, not an investment in an Israeli company.)¹³ No public evidence identified.

Patents & IP Co-Development with Israeli Institutions

No public evidence was identified of patent portfolios, licensing, or co-development arrangements between Costco and Israeli-domiciled entities or research institutions (Technion, Hebrew University, Weizmann Institute). No public evidence identified.

Supplier Code of Conduct - Technology Supply-Chain Provisions

Costco maintains a Supplier Code of Conduct addressing ethical obligations for its product supply chain.¹⁷ No public version reviewed contains provisions governing the national origin or geopolitical exposure of technology vendors, software suppliers, or digital-infrastructure providers, nor a technology-supply-chain due-diligence framework specific to vendor geopolitical exposure. No public evidence identified.

Consumer Hardware Sold Through Costco (Direction: retail of goods, not provision)

For completeness: Kirkland Signature hearing aids sold through Costco are manufactured under an OEM relationship with Sonova Group, a Swiss-headquartered company; no Israeli-origin hardware or software component of that product line has been identified.¹⁸ This is a retail-of-goods relationship, not a technology-provision relationship to any Israeli entity. No public evidence identified of an Israel nexus in this product line.

Civil Society Scrutiny & Regulatory History

NGO & Academic Scrutiny - Technology Supply Chain

No public evidence was identified of an NGO investigation, academic study, or UN report addressing Costco’s technology relationships with the Israeli state, Israeli defence entities, or Israeli-origin technology vendors. Civil-society attention on Costco in relation to Israel has centred on physical products sold on its shelves (the Economic domain), not on technology procurement or digital-infrastructure provision.

Who Profits - Keter Group / Barkan (product, not technology)

The Who Profits Research Center has documented Keter Plastic / Keter Group, an outdoor-furniture and storage manufacturer whose products have been sold through Costco. Who Profits recorded a factory in the Barkan Industrial Zone, an Israeli settlement industrial park in the occupied West Bank, and documented Keter trucks at the Barkan facility in March 2014 despite the company’s denials; Who Profits subsequently published an update indicating Keter ended its activity in the occupied Palestinian territory.¹⁹²⁰ Keter is majority-owned by private-equity firm BC Partners (acquired 2016).²¹ This is a consumer-product sourcing/sale concern, not a technology relationship; the Who Profits records do not mention Costco by name.¹⁹²⁰

BDS Campaigns Targeting Costco (product-focused)

Costco has been the subject of BDS consumer campaigning, primarily directed at physical goods on its shelves - Medjoul dates from Israel, Sabra hummus (linked to Israel’s Strauss Group), SodaStream, and Keter products - including a 2024 in-person protest in Sherbrooke, Quebec and listing as a lower-tier BDS target.²²²³ SodaStream, sold through Costco and now owned by PepsiCo, relocated its primary manufacturing from the Mishor Adumim settlement to an industrial park near Rahat in southern Israel by 2015–2019.²⁴ No public evidence was identified of a BDS or NGO campaign specifically targeting Costco’s technology relationships, software licensing, or digital-infrastructure provision; documented campaigning concerns merchandise.

Data-Protection Litigation - Pharmacy Website Tracking

Two proposed class-action lawsuits filed in Washington federal court in October 2023 allege that Costco’s pharmacy website used web-tracking pixels (including the Meta Pixel) to transmit users’ sensitive health-related information to third parties such as Meta/Facebook and Google without consent, asserting HIPAA, FTC Act, and wiretapping-law violations affecting potentially over one million people.²⁵ The third parties named are US-origin technology companies; no Israeli company or Israel nexus is identified in the reporting reviewed. This concerns Costco’s own data-handling practices and has no connection to any Israeli-origin technology relationship.²⁵

Export Controls & Sanctions Authorities

No public evidence was identified of any action by US export-control or sanctions authorities (OFAC, BIS), the SEC, or any equivalent body relating to Costco technology sales, services, or data transfers to Israeli state entities. No public evidence identified.

Regulatory & Legal Actions - Technology Sales to Israeli State Entities

No public evidence identified of any regulatory, export-control, or sanctions-body action relating to Costco technology sales or services to Israeli state entities.