Lidl notifies online shop customers of breach at a service provider

Discount supermarket chain Lidl has notified online shop customers in Germany, Belgium, and the Netherlands of a data breach that stemmed from a hack at one of its service providers rather than Lidl's own systems. According to the company, the exposed information involves customer contact and order-related details, while payment card data was not affected. The incident is another example of third-party or supply-chain risk, where attackers compromise a vendor to reach a larger brand's customer data. Even without financial data, the exposed details can fuel convincing phishing and scams that impersonate Lidl, especially messages referencing real orders to make fraudulent requests look legitimate to shoppers who recently used the online shop.

Check

Lidl online shop customers in the affected countries should watch for the notification, be wary of messages referencing Lidl or their orders, and avoid clicking links or sharing details in unsolicited messages.

Affected

Lidl online shop customers in Germany, Belgium, and the Netherlands whose contact and order details were exposed through a hacked service provider; payment card data was not affected.

Fix

Treat Lidl-themed messages with caution and verify through official channels. Organizations should assess vendors' security, limit the customer data third parties hold, and require breach-notification and security commitments in supplier contracts.