Lidl data breach via third-party provider

Lidl, the German discount supermarket chain owned by Schwarz Group, disclosed a data breach affecting online shop customers in Germany, Belgium, and the Netherlands. The breach occurred at a third-party IT service provider, where attackers briefly accessed a file containing personal data including names, phone numbers, email addresses, dates of birth, and customer numbers. Passwords, payment details, and addresses were not compromised. Lidl notified affected customers and relevant data protection authorities, including the Dutch Netherlands — Autoriteit Persoonsgegevens. The service provider filed a police report and engaged forensic experts. While no evidence of data misuse has been found, Lidl warned customers of potential phishing and identity fraud attempts. The incident raises questions about third-party security controls and GDPR compliance.