Lidl Confirms Data Breach Following Cyberattack on Third-Party IT Service Provider
Lidl, the discount supermarket chain operated by the Schwarz Group, has recently confirmed that a cyberattack affecting one of its third-party IT service providers has exposed the personal data of customers who shopped online in Germany, Belgium, and the Netherlands. This incident marks yet another significant breach in the series of supply-chain attacks that have targeted major European retailers throughout this year.
In a statement released following the incident, Lidl specified that it was notified of the cyberattack last week. The company acted swiftly to inform affected customers through emails and published breach notices on its support websites for Germany, Belgium, and the Netherlands. Lidl emphasized that while unauthorized individuals briefly accessed “a separately stored file containing customer data,” the core online shop system itself remained secure.
This breach underscores a critical vulnerability in the retail sector, revealing how reliant these businesses are on third-party service providers. Boris Cipot, a principal security engineer at Black Duck, remarked on the significance of this vulnerability, stating, “This incident is a textbook reminder that your security posture is only as strong as your weakest third party. Even when a retailer’s own systems hold, a compromised service provider can expose millions of customers to identity fraud, phishing, and account takeover attacks.”
The data that has been compromised includes sensitive information such as customers’ salutations, first and last names, phone numbers, email addresses, dates of birth, and customer numbers. However, Lidl assured its customers that no passwords, billing or delivery addresses, bank details, or other payment information had been breached, and that customer accounts themselves remained secure. Furthermore, the affected IT service provider has reportedly taken immediate action to restore full security to its systems.
Consumer privacy advocate Paul Bischoff of Comparitech commented on the situation, noting that while the nature of the stolen information limits the immediate risks, the potential for phishing remains high. He stated, “Although the breach is unfortunate, the compromised data doesn’t pose a direct threat to victims’ money or identities. However, scammers could use the data to launch tailored phishing attacks and other scams, so consumers should be vigilant regarding malicious emails and text messages.”
Cipot acknowledged the manner in which Lidl has handled the disclosure thus far but also cautioned that the real challenge lies in how the company responds moving forward. “Lidl deserves credit for moving quickly to notify customers and being transparent about what they don’t yet know, including the possibility that passwords, addresses, and payment data could be involved. The real test now is follow-through: how quickly they complete the forensic investigation, how clearly they communicate updates as the scope becomes known, and how rigorously they reassess the security requirements they place on their service providers going forward,” he said.
In light of the breach, Lidl has filed a police report and engaged external IT forensic experts to investigate the incident’s scope. The company has also notified relevant data protection authorities in the Netherlands and Belgium. However, Lidl has refrained from naming the compromised service provider or revealing the number of customers affected. At the time of the report, no hacking group had openly claimed responsibility for the cyberattack.
As Europe’s largest food retailer, Lidl operates approximately 12,900 stores across 32 countries, employing over 376,000 individuals. The company’s recent breach contributes to a troubling trend, as several retailers have faced similar supply-chain and third-party attacks over the past year. This list includes well-known brands such as Marks & Spencer, Co-op, Louis Vuitton, Pandora, and Harrods, many of which have been linked to the Scattered Spider hacking group.
Cybersecurity advisor Muhammad Yahya Patel of Huntress emphasized the alarming consistency of these breaches. “Another major retailer, another third-party service provider breach. The pattern is consistent enough now that it needs calling out clearly; one of the weakest points in most organizations’ security posture isn’t their own systems, it’s the extended ecosystem of service providers that touch customer data peripherally.”
Lidl has urged its customers to exercise caution and vigilance in the wake of the breach, reminding them to verify the authenticity of any communications they receive before sharing any personal information or clicking on links. Patel directly advised anyone who has shopped online with Lidl in the affected regions to change their passwords immediately and to avoid reusing passwords across different platforms.
Cipot echoed this sentiment, reinforcing that customers should treat the breach as a wake-up call. He encouraged users to change their Lidl passwords promptly, enable multi-factor authentication where available, and remain alert to phishing attempts that may reference their Lidl account or recent orders. “Attackers will absolutely weaponize this stolen data to craft convincing scams in the weeks and months ahead. Monitor your bank and card statements closely and consider a credit freeze if that option is available,” he warned.
As the investigation unfolds, consumers and security experts alike will be watching closely to see how Lidl navigates this crisis and what measures will be implemented to mitigate the risks associated with future breaches. The importance of robust cybersecurity practices among all service providers within a retailer’s supply chain has never been more apparent.