Lidl shop data leak: Customer data stolen from service provider

The discounter Lidl experienced a data protection incident. The company informed affected customers. Unauthorized individuals gained access to a file with customer data from a shop service provider and exfiltrated it. Lidl has informed the responsible data protection authority. It is unclear who is behind the attack.

The attackers stole the salutation, first and last name, phone number, email address, date of birth, and customer number of the affected customers. As a spokesperson informed us upon request, neither postal addresses nor passwords or payment information are affected. The customer accounts were not compromised, the spokesperson further states.

The attack did not affect the central database of the shop system, but an IT service provider of the retail group. This provider reacted immediately and “took the necessary measures to fully secure the IT systems again,” according to the spokesperson. Furthermore, the service provider filed a criminal complaint.

There are no indications of data misuse, according to the email we received. Nevertheless, affected individuals should remain vigilant against phishing and identity theft, Lidl recommends.

Lidl, like the cloud provider Schwarz Digits and the security company XM Cyber, also belongs to the Schwarz Group.

This article was originally published in German . It was translated with technical assistance and editorially reviewed before publication.