Lidl customers in Germany, Belgium, and the Netherlands may want to check their inboxes after attackers stole personal data linked to the retailer’s online shops.
The incident involved an external IT service provider, where attackers accessed a separate file containing names, phone numbers, email addresses, dates of birth, and customer numbers. Lidl said passwords, payment details, bank information, and billing or delivery addresses were not exposed, but the stolen identity data could still help criminals create convincing phishing messages, impersonate the retailer, or attempt identity fraud.
The incident also raises fresh questions about third-party security controls and GDPR obligations for European companies that rely on outside vendors to handle customer information.
Attackers accessed a separate customer file
According to BleepingComputer, Lidl said that unknown attackers briefly accessed a separate file containing information belonging to online shop customers. The retailer said the online shop system itself remained unaffected and customer accounts were not compromised.
“Despite high IT security standards, unknown individuals briefly gained access to a separately stored file containing customer data, and part of the data was stolen from it,” Lidl said in a customer notification, according to BleepingComputer.
The stolen records included customers’ titles, first and last names, phone numbers, email addresses, dates of birth, and customer numbers.
Lidl said attackers did not obtain passwords, payment details, bank information, or billing and delivery addresses, according to TechRadar. The company has not disclosed how many customers were affected or which service provider was involved.
RetailDetail noted that affected customers in Belgium and the Netherlands were contacted directly. Lidl also published notices on its support sites for customers using the online shops in those markets.
Phishing remains the clearest risk
The lack of exposed passwords and financial data reduces the immediate risk of account takeover or direct payment fraud. Still, the information taken could make scam messages look far more convincing.
Names, dates of birth, phone numbers, email addresses, and customer numbers could help criminals impersonate Lidl representatives and cite a supposed refund, delivery issue, account alert, or security check.
“We currently have no concrete evidence of data misuse. Nevertheless, as a precaution, we warned affected customers against possible phishing attempts or identity abuse,” a Lidl spokesperson told BleepingComputer.
Customers should avoid clicking links in unexpected Lidl-branded emails or text messages. Visiting Lidl’s official website or app directly is safer than responding to a message that requests login details, payment information, or urgent identity verification.
Must-read security coverage
- UK Police Convicts Pair in £5.5 Billion Bitcoin Launder Case
- Blackpoint Cyber vs. Arctic Wolf: Which MDR Solution is Right for You?
- How GitHub Is Securing the Software Supply Chain
- 8 Best Enterprise Password Managers
The incident puts vendor security under scrutiny
The breach shows how customer risk can extend beyond a retailer’s own systems. European organizations remain responsible for assessing how external providers store, secure, and process personal information, especially when the data is subject to GDPR.
Separating the file from the main online shop may have helped contain the intrusion. The copied data still contained enough personal detail to enable targeted fraud, showing that segmentation limits damage but does not eliminate the need for strong vendor monitoring and access controls.
TechRadar said that the service provider restored its systems, filed a police report, and hired forensic specialists to investigate. Lidl also notified relevant privacy regulators, including the Dutch Data Protection Authority.
The remaining questions include how attackers gained access to the provider, how long they had access, and whether the stolen records have been shared or misused.
Until investigators provide more detail, affected customers should remain alert for personalised phishing attempts, while European businesses may want to review how much customer data their vendors hold and how quickly an incident would be detected.
Also read: Hackers claimed to have stolen 1.3 TB of data from Danish drugmaker Novo Nordisk, raising concerns about cyber risks across Europe’s healthcare sector.