Loading story…
Lidl disclosed a customer data breach affecting users of its online shop in Germany, Belgium, and the Netherlands after attackers compromised an external IT service provider and briefly accessed a separately stored file. The retailer said its online shop systems were not breached directly, but the exposed data includes customer names, telephone numbers, email addresses, dates of birth, salutations, and customer numbers.
Lidl said it cannot yet rule out exposure of passwords, billing and delivery addresses, bank details, or other payment information, although it has not reported concrete evidence of misuse so far. The service provider has restored system security, filed a police report, and engaged forensic experts, while Lidl notified the relevant data protection authority, including the Dutch regulator, and warned affected customers to watch for phishing attempts and identity fraud.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Lidl disclosed the customer data breach, warned affected customers about phishing and identity fraud risks, and said it had notified the relevant data protection authority, identified in one report as the Dutch Data Protection Authority.
Following the breach, the affected IT service provider reportedly restored system security, filed a police report, and engaged IT forensic experts to investigate the incident.
Lidl said unidentified attackers briefly accessed a separately stored file at one of its external IT service providers, exposing customer data tied to online shop users in Germany, Belgium, and the Netherlands. Lidl stated its online shop systems themselves were not affected.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
11 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourceitpro.com
Open sourceitsecurityguru.org
Open sourceteiss.co.uk
Open sourcebleepingcomputer.com
Open sourceservice.lidl.nl
Open sourcehelpnetsecurity.com
Open sourcecustomerservice.lidl.be
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
French retailer **LDLC** disclosed a breach affecting customers of its physical stores after stolen data was advertised for sale on a hacking forum. The exposed dataset reportedly included **1.26 million unique email addresses** along with customers' names, phone numbers, and physical addresses, indicating broad exposure of personally identifiable information tied to retail transactions. Emirati retailer **LuLu** also suffered a customer data breach in which an initial set of about **190,000 email addresses** and linked phone numbers was shared on a hacking forum. The incident escalated when the threat actor later leaked a larger backup from **October 2022**, exposing an additional **2.6 million unique email addresses** as well as names, physical addresses, order data, and **`PBKDF2` password hashes**, significantly increasing the risk of account compromise and follow-on phishing or fraud.
Jun 29, 2026
**Loblaw Companies Limited** disclosed that attackers gained unauthorized access to a contained, non-critical portion of its IT network and exfiltrated basic customer information. The company said the exposed data includes **names, phone numbers, and email addresses**, while its investigation has so far found no evidence that **passwords, payment card data, health or pharmacy records, or PC Financial systems** were compromised. Loblaw said it detected suspicious activity, contained the affected environment, and launched an investigation into the intrusion. Reporting on the incident indicates the breach affected customer records stored in that segmented environment, creating follow-on risk of **phishing and social engineering** against impacted individuals. As a precaution, Loblaw logged customers out of their accounts, and external reporting noted no public threat actor claim tied to the intrusion at the time of publication. The available information indicates a limited but confirmed exposure of personally identifiable information rather than a compromise of Loblaw’s core operational, financial, or medical data systems.
Jun 29, 2026
Dutch authorities reported a prolonged compromise at the Dutch prisons agency **DJI**, where attackers reportedly maintained access for at least **five months**. Exposed information included staff **email addresses, phone numbers, and security certificates**, and the Dutch NCSC indicated the intruders also accessed **phones, tablets, and laptops**, though the extent of data access on those endpoints was not confirmed; DJI did not confirm whether access had been fully removed. Separately, Dutch telecom **Odido** disclosed a **data breach followed by an extortion attempt**, after which attackers publicly released about **1M records** (including **317k unique email addresses**) and threatened additional leaks. The published data reportedly included **names, physical addresses, phone numbers, bank account numbers**, and customer-service notes; Odido’s notice also warned that **dates of birth** and government ID numbers (passport/driver’s license) were impacted. A **Canadian Tire** breach entry describes a different incident in Canada (October 2025) involving ~**42M records** with PBKDF2-hashed passwords and some partial payment-card metadata, and is not part of the Netherlands-focused events above.
Jun 29, 2026