Customer Records Stolen in Lidl Data Breach Across Europe

Lidl told online shop customers in Germany, Belgium, and the Netherlands last week that personal data was stolen after attackers breached an external IT service provider, not Lidl’s online shop system itself.

The Lidl data breach affected customer records tied to its online shops in those three markets, according to Security Affairs. Lidl said payment data was not exposed, and its notices in Belgium and the Netherlands said the online shop system was not compromised.

Lidl data breach came through an external IT provider, not the shop system

Lidl, owned by Schwarz Group, said it contacted affected online shop customers after learning that unidentified individuals briefly accessed a separately stored customer data file at one of its service providers.

The scope matters. This concerns online shop customers in Germany, Belgium, and the Netherlands, not every Lidl shopper and not necessarily in-store customers.

“Despite high IT security standards, unidentified individuals were briefly able to access a separately stored file containing customer data and steal some of it. The online shop system itself was not affected.”

That line appeared in Lidl’s Netherlands notification. The Belgian notice used similar wording and said the company was informed of the incident earlier in the week.

Lidl said the stolen data includes:

• Salutation: Customer title or form of address.
• Name: First and last name.
• Contact details: Phone number and email address.
• Date of birth: A useful identity marker for fraud attempts.
• Customer number: The identifier tied to Lidl’s online shop customer records.

Lidl’s Belgian notice explicitly said passwords, billing and delivery addresses, bank details, and other payment information were not involved. It also said customer accounts were not compromised.

That distinction reduces the immediate risk of direct payment fraud. It doesn’t erase the customer risk.

Payment data was spared, but the stolen details can still fuel fraud

The exposed data is enough to make a scam look credible. A fraudster with a name, phone number, email address, date of birth, and customer number can write a Lidl-branded message that feels specific rather than generic.

That’s the danger in this Lidl data breach. The stolen file may not contain bank details, but it gives attackers the ingredients for targeted phishing emails, scam calls, fake refund notices, delivery issue messages, or account verification lures.

Lidl said there is currently no concrete evidence of misuse. That is useful, but limited. Breach notices often include that phrasing before stolen data appears in scam attempts or is combined with other information.

Customers who received Lidl’s notification should treat unexpected Lidl messages with extra caution. Don’t click links in surprise emails or texts claiming there’s a refund, failed delivery, account issue, or urgent verification request. Go through Lidl’s official website or customer service channels instead.

Lidl listed contact addresses for suspicious activity in the affected markets, including [email protected] and [email protected].

XOOMAR analysis: the biggest near-term exposure is not account compromise at Lidl, based on the company’s own statements. It is social engineering. Retail customer data is valuable because attackers can anchor the scam in a real relationship: the recipient actually used Lidl’s online shop.

That same trusted-platform problem sits behind other cyber stories we’ve tracked, including Ghost Accounts Forge Attack Maps With GitHub API Abuse, where the risk comes from attackers operating through systems users already recognize.

Dutch authority notified as Lidl supplier brings in forensic experts

Lidl’s Netherlands notification said the company informed the Autoriteit Persoonsgegevens, the Dutch Data Protection Authority. It also said the affected IT service provider filed a police report and brought in forensic IT experts to investigate the full scope of the incident.

Those details shift the story into its next phase. Lidl and the vendor now face the questions that matter most: how the file was accessed, how long the attackers had access, how many customers were affected in each country, and whether the stolen data has surfaced anywhere else.

European customer data incidents can trigger GDPR notification duties depending on the risk and nature of the exposed information. In this case, Lidl has at least confirmed notification to the Dutch authority. The available notices also show the company contacted customers directly.

The supplier has not been named in the supplied material. Lidl has also not disclosed how many customers were affected.

That leaves several open items for updates:

• Affected customer count: Lidl has not said how many people were included.
• Country split: Germany, Belgium, and the Netherlands are named, but no per-market figures are available.
• Supplier identity: The external IT service provider has not been identified.
• Attack method: Lidl has not said how the file was accessed.
• Misuse evidence: Lidl says it has no concrete evidence so far.

The incident also lands in a wider European security reporting cycle, where cyber risk is increasingly mixed with political and commercial pressure. XOOMAR has covered that broader regional pressure in Europe Turns Up Heat on Putin as Ukraine Talks Hit Paris, though Lidl’s case is a corporate data incident, not a state-linked claim based on the available facts.

For Lidl customers, the practical next step is narrow and immediate: assume any Lidl-branded message could be spoofed, verify through official channels, and avoid links in unsolicited emails or texts. For Lidl, the next credibility test is disclosure. The company has said what was not stolen. Customers and regulators will now want the missing numbers, the supplier name, and the forensic timeline.

Impact Analysis

• Affected customers in Germany, Belgium, and the Netherlands may face phishing or identity-fraud attempts using stolen personal details.
• Lidl says payment data and passwords were not exposed, limiting the immediate financial risk.
• The incident highlights how third-party service providers can create security exposure even when a company’s own systems are not breached.