Ransomware Hits Naval Contractor, Lidl Discloses Data Breach, and Iran Tracks US Military Phones
A defence shipbuilder confirms a ransomware attack, a major supermarket chain notifies customers of stolen data, and new evidence suggests Iranian operatives tracked phones belonging to US military personnel.
Key points
- Ransomware, malicious software that locks files until a payment is made, struck TKMS, a German naval defence contractor that builds submarines for NATO member states.
- Lidl, the international supermarket chain, disclosed a data breach affecting an unspecified number of customers.
- Evidence emerged that Iranian operatives tracked mobile phones belonging to US military personnel, raising counterintelligence concerns.
- A coordinated vulnerability disclosure blueprint, a shared set of rules for how researchers should responsibly report security flaws to vendors, was published to help standardise industry practice.
Three stories from SecurityWeek's latest roundup each carry disclosure angles worth unpacking.
Should ordinary people be worried about any of this?
If you shopped at Lidl and stored your details in their app or loyalty programme, pay attention. We reported on 13 July that a supplier breach had already exposed names, phone numbers and dates of birth for Lidl shoppers in Germany, Belgium and the Netherlands; this new disclosure suggests the exposure isn't contained. Lidl hasn't published a full breakdown of what categories of data were taken, which matters because email addresses are nuisance-level, while payment details or identity documents are a different matter. Until Lidl publishes specifics, treat unexpected emails claiming to be from Lidl as suspicious and change your account password now.
The TKMS ransomware attack sits in a different category. TKMS builds submarines and surface vessels for several European navies. The company hasn't confirmed whether operational or classified data was accessed, only that systems were affected. Ransomware gangs routinely steal files before locking them, using the threat of publication as a second lever for payment. If sensitive naval specifications were taken, Germany's BSI-Gesetz, the federal law governing critical infrastructure security, and the EU's NIS2 Directive both carry mandatory notification obligations that would come into sharp focus.
The Iran-and-military-phones story carries its own disclosure wrinkle. Tracking infrastructure linked to Iranian state actors is the reported mechanism here. Whether any US government agency faced a formal notification obligation depends on how the devices were classified and whether they touched government networks. That question stays open. Our 9 July story on Iranian groups scanning broadly for unlocked doors shows this isn't a narrowly targeted campaign.
For all three stories, the practical lesson is identical. Reuse a password across accounts and one breach hands criminals a key to several doors. Use a different password for every account; a free password manager handles the memory work.
The coordinated vulnerability disclosure blueprint is a quieter but genuinely useful development. It gives researchers and companies a shared playbook for reporting flaws without the researcher facing legal threat and without vendors sitting on fixes. That process, when it works, keeps the rest of us safer.
