Lidl Data Breach Exposes Customer Information Across Europe

Lidl has warned customers in Germany, Belgium, and the Netherlands that attackers stole personal information during a cyberattack on one of its external service providers.

The supermarket chain says the attackers accessed customer data stored outside its online shop, while the online shopping platform itself remained secure.

Service Provider Suffers Data Breach

Lidl informed affected customers by email and published separate breach notices for customers in Belgium and the Netherlands.

According to the company, attackers briefly accessed a standalone database containing customer information before stealing part of its contents.

Lidl stressed that the attackers did not compromise its online shop infrastructure.

Stolen Customer Information

The company says the stolen data includes information belonging to online shop customers, including:

• Salutation
• First and last name
• Telephone number
• Email address
• Date of birth
• Customer number

Although investigators have not confirmed additional data theft, Lidl says it cannot yet rule out that the incident may also involve passwords, billing addresses, delivery addresses, bank details, or other payment information.

Investigation Underway

Lidl says the affected IT service provider has reported the incident to police and hired digital forensic specialists to investigate the attack.

The supermarket chain has also notified the Dutch Data Protection Authority about the breach.

Investigators continue to examine the incident to determine exactly what information the attackers accessed.

Lidl Warns Customers About Phishing

Although Lidl has not found evidence that criminals have misused the stolen information, the company urges customers to remain alert for phishing emails and identity fraud.

Customers should verify the sender of unexpected emails or messages before responding. Lidl also advises customers not to click suspicious links or provide personal information unless they can confirm the request is legitimate.

The company has not disclosed who carried out the attack or whether the attackers have demanded a ransom.