Lidl Announces Data Breach Affecting Customers in Germany, Belgium, and Netherlands
Customer information stolen in third-party provider attack.
1Lidl discloses data breach
Lidl notified online shop customers in Germany, Belgium, and Netherlands about a data breach. Customer data was stolen in an attack targeting an external IT service provider. The company confirmed payment details remained unaffected by the incident.
2What information was compromised?
Stolen data includes titles, full names, phone numbers, email addresses, dates of birth, and customer numbers. Lidl clarified that passwords, billing/delivery addresses, and banking details weren't exposed. Customer accounts remain secure according to official statements.
3How the breach occurred
Despite high security standards, attackers briefly accessed a separately stored customer data file at an external provider. Lidl emphasized that the online shop system itself wasn't compromised, only this external backup file was targeted in the attack.
4Regulatory notifications
Lidl reported the incident to Autoriteit Persoonsgegevens (Dutch Data Protection Authority). The IT service provider filed a police report and engaged forensic experts. Currently, there's no concrete evidence of actual misuse of the stolen data.
5Potential risks and precautions
The stolen personal data could enable phishing attempts. Lidl warned customers to be cautious about unexpected communications and to verify senders before clicking links. Suspicious messages should be reported to [email protected] or [email protected].
6Retail industry implications
This incident highlights how third-party vendor vulnerabilities can impact major brands. Retailers must reassess supply chain security and implement layered protections for customer data, especially when using external service providers.
Original article: Security Affairs — Lidl, Almanya, Belçika ve Hollanda'daki veri ihlalini duyurdu