Lidl Customers in Three Countries Warned After Supplier Breach Exposes Personal Data
The German discount chain says a file at an outside IT provider was raided, spilling names, phone numbers and dates of birth for online shoppers in Germany, Belgium and the Netherlands.
Key points
- Lidl told online shop customers in Germany, Belgium and the Netherlands last week that attackers stole personal data from a file held at an outside IT service provider.
- Confirmed stolen data includes name, phone number, email address, date of birth and customer number.
- Lidl says it cannot yet rule out that passwords, billing addresses, bank details or payment information were also taken.
- The supplier has filed a police report and hired forensic investigators, and Lidl has notified the Dutch Data Protection Authority.
- Lidl is warning affected shoppers to expect phishing attempts, meaning fake emails or texts designed to trick them into handing over more information.
Lidl, the discount supermarket owned by Germany's Schwarz Group, has told customers that criminals broke into a file at one of its IT suppliers and walked away with their personal details.
The notice went out by email last week. Separate alerts appeared on Lidl's support pages in Belgium and the Netherlands. Germany is also affected.
Schwarz Group is the biggest food retailer in Europe. Lidl alone runs around 12,000 stores and employs more than 376,000 people across Europe and the United States. That scale is why a leak at a single supplier ripples across three countries at once.
What exactly was stolen?
Lidl has confirmed that the attackers took customer records from the online shop, not from stores. The breached file held each shopper's name, phone number, email address, date of birth and internal customer number. Salutation was also included.
In its own words: "Despite high IT security standards, unknown individuals briefly gained access to a separately stored file containing customer data, and part of the data was stolen from it. The online shop's system itself was not affected."
That last line matters. The shop's live systems, where you log in and pay, weren't broken into. The stolen file sat elsewhere, at an outside IT service provider whose name Lidl hasn't published.
But the company is careful. It says it can't yet rule out that passwords, billing addresses, bank details or other payment information were also caught up in the theft. Investigators are still working out the full scope.
Who is investigating?
The hacked IT supplier has filed a police report and brought in outside forensic experts, the kind of specialists who reconstruct exactly what an intruder touched and copied.
Lidl has formally notified the Dutch Data Protection Authority, the regulator that enforces the EU's General Data Protection Regulation (GDPR) in the Netherlands. Similar notifications are expected in Germany and Belgium, where national data protection regulators have jurisdiction.
We've covered GDPR enforcement across 17 stories in the last 90 days, and the supplier-as-weak-link pattern keeps showing up. The incident was first reported by BleepingComputer. Lidl hadn't responded to press questions at the time of writing.
Should Lidl shoppers be worried?
Yes, but the risk right now is phishing rather than direct fraud. Criminals holding your name, phone number, email and date of birth can craft convincing fake messages that look like they come from Lidl, your bank or a parcel courier.
Lidl's notice added that it has "no concrete evidence of data misuse" but is warning customers as a precaution. It put the advice plainly: "Be alert for unexpected messages. Always verify the authenticity of the sender. If you notice anything unusual, do not provide any data and do not click on unknown links."
What affected customers should do
If you have a Lidl online shop account in Germany, Belgium or the Netherlands, treat unexpected emails, SMS or WhatsApp messages mentioning Lidl, deliveries or refunds with suspicion. Don't click links inside them. Go directly to the Lidl website by typing the address yourself.
Change your Lidl password, and change it anywhere else you've reused the same one. Turn on two-factor authentication, an extra login code sent to your phone, wherever your email or bank offers it. Watch card statements for small unfamiliar charges, a common early sign that stolen data is being tested.
The honest read here: the confirmed data set is relatively modest, but the unresolved question about passwords and payment details is the one to watch. If Lidl's follow-up notice confirms those were taken too, the threat level shifts sharply.
