Lidl has disclosed that customer data from its online shop was exposed following a cyberattack on a company that helps run the store’s backend systems. The attackers accessed a separate file containing customer records — Lidl’s own online shop systems were not directly compromised. The breach affected customers who shopped online with Lidl in Germany, Belgium, and the Netherlands.
The confirmed stolen data includes customers’ first and last names, salutation, telephone numbers, email addresses, dates of birth, and Lidl customer numbers. Lidl says it cannot rule out that passwords, billing addresses, delivery addresses, bank details, and payment information may also have been taken. The service provider involved has filed a police report and brought in forensic investigators to determine the full scope of the breach.
How to check if you’re affected
Affected products include the Lidl online shop and associated accounts registered through Lidl’s websites in Germany (lidl.de), Belgium, or the Netherlands. If you have a Lidl online shopping account in any of these countries, assume your basic contact details were exposed.
Steps to take:
- Change your Lidl account password immediately.
- Watch for suspicious emails or texts claiming to be from Lidl — the stolen data is likely to be used in targeted phishing attempts.
- If you used the same password elsewhere, change it on those other sites too.
- If you notice unexpected bank charges, contact your bank right away.
Sources
- Lidl discloses online shop breach after service provider hack — BleepingComputer