Lidl Customer Data Stolen in IT Service Provider Breach German discount supermarket chain Lidl has disclosed a data breach affecting customers in Germany, Belgium, and the Netherlands after attackers compromised one of its IT service providers. The company revealed the incident in notices posted on its support websites last week. The breach allowed unidentified threat actors to access and exfiltrate a file containing customer data, though Lidl confirmed its online shop system remained unaffected. Compromised information includes names, telephone numbers, email addresses, dates of birth, customer numbers, and salutations. While passwords and payment details may also have been exposed, Lidl stated that customer accounts were not directly impacted. Though no evidence of data misuse has been found, the company issued a precautionary warning about potential phishing attempts or identity fraud. The affected IT service provider has since secured its systems, filed a police report, and engaged forensic experts to investigate the incident. Lidl also notified the relevant data protection authority. No details about the attackers or their motives have been released.

Lidl Netherlands Reports Customer Data Breach Affecting Webshop Users Lidl Netherlands has disclosed a data breach impacting customers who used its webshop, revealing that unauthorized individuals accessed personal information. The stolen data includes names, telephone numbers, email addresses, dates of birth, and customer numbers. However, the supermarket chain confirmed that passwords, billing addresses, delivery details, and payment information including bank details remained secure. The company has notified affected customers via email and reported the incident to the Dutch Data Protection Authority (AP). While Lidl has not disclosed the number of impacted individuals, it stated there is no evidence of the stolen data being misused. The breach highlights ongoing cybersecurity risks for retailers, particularly in e-commerce platforms where customer data is stored. Lidl’s response follows standard protocol, including regulatory reporting and direct communication with those affected. Further details on the breach’s scope or the attackers’ methods have not been released.

Lidl Data Breach Exposes Customer Information Across Three European Countries Lidl has alerted customers in the Netherlands, Belgium, and Germany about a data breach involving an external IT vendor. According to reports, unidentified threat actors accessed and partially copied a file containing personal data, including names, phone numbers, email addresses, dates of birth, and customer numbers. The breach did not expose passwords, billing addresses, or bank details, and Lidl’s online shop remained unaffected. The incident highlights the risks of third-party vendor vulnerabilities in supply chain attacks. This breach follows a series of high-profile cyber incidents in the retail sector, including a 2024 attack on UK retailer Marks & Spencer, which disrupted operations and led to an estimated £300 million loss in operating profit. Around the same time, Co-op UK also faced attempted cyber intrusions. Authorities later arrested four individuals in connection with attacks on M&S, Co-op, and Harrods. Meanwhile, Lidl’s parent company, Schwarz Group, reported a 5.8% revenue increase to €185.6 billion in its 2025 financial year, alongside a 2.4% growth in its workforce.