Lidl reports data breach affecting online customers in Germany, Belgium, and the Netherlands

Per Security Affairs, Lidl has disclosed a data breach impacting customers of its online shop in Germany, Belgium, and the Netherlands, stemming from a cyberattack on an external IT service provider. The incident, discovered early last week, involved unauthorized access to a file containing personal customer information.

The compromised data includes customer salutations, first and last names, phone numbers, email addresses, dates of birth, and customer numbers. Lidl has explicitly stated that payment data, including bank details and billing or delivery addresses, was not affected, and customer accounts remain secure. The breach occurred at a third-party IT service provider, not within Lidl's core online shop system. The discount chain, owned by Schwarz Group, has notified affected customers and informed relevant data protection authorities, including the Dutch Autoriteit Persoonsgegevens.

The compromised service provider has filed a police report and initiated a forensic investigation. While there is currently no concrete evidence of data misuse, the exposed information could be used for phishing or impersonation attempts. Customers are advised to exercise caution with unexpected communications claiming to be from Lidl and to verify sender details.

Source: Security Affairs