Lidl Customer Data Breach Exposes Personal Information Across Germany, Belgium, and the Netherlands Attackers stole personal data from Lidl customers in Germany, Belgium, and the Netherlands after breaching an external IT service provider handling the retailer’s online shop operations. The compromised file contained names, phone numbers, email addresses, dates of birth, and customer numbers but no passwords, payment details, or billing addresses. Lidl confirmed that the breach targeted a separate customer data file, leaving the main online shop system and accounts unaffected. While the company has not disclosed the number of affected customers or the identity of the third-party vendor, it directly notified impacted individuals in Belgium and the Netherlands and posted advisories on its support sites. The stolen data poses a heightened risk of phishing attacks, as criminals could use the information to craft convincing scam messages impersonating Lidl. Though no evidence of misuse has emerged, Lidl warned customers to remain cautious of unsolicited communications requesting personal or financial details. The incident underscores vulnerabilities in third-party security, particularly for European companies subject to GDPR. While segmenting data may have limited the breach’s scope, it highlights the need for stricter vendor oversight. The service provider has since restored systems, filed a police report, and engaged forensic investigators, while Lidl notified relevant data protection authorities. Key questions remain unanswered, including how attackers gained access, the duration of the breach, and whether the stolen data has been exploited. The investigation is ongoing.