Lidl Customer Data Stolen After Breach at External IT Service Provider

Lidl disclosed a customer data breach affecting users of its online shop in Germany, Belgium, and the Netherlands after attackers compromised an external IT service provider and briefly accessed a separately stored file. The retailer said its online shop systems were not breached directly, but the exposed data includes customer names, telephone numbers, email addresses, dates of birth, salutations, and customer numbers.

Lidl said it cannot yet rule out exposure of passwords, billing and delivery addresses, bank details, or other payment information, although it has not reported concrete evidence of misuse so far. The service provider has restored system security, filed a police report, and engaged forensic experts, while Lidl notified the relevant data protection authority, including the Dutch regulator, and warned affected customers to watch for phishing attempts and identity fraud.