Lidl online shop customer details stolen through IT service provider
Attackers stole Lidl online shop customers’ personal details in Germany, Belgium and the Netherlands through an IT provider. Lidl says passwords and payment details were unaffected. Watch for convincing fake Lidl messages and verify them independently.
If Lidl notified you, watch for unexpected emails, texts or calls that use your personal details. Verify requests through Lidl’s official website before sharing information or following links. There is no software update to install; Lidl says passwords and payment information were unaffected.
What’s happening
Lidl began notifying affected online shop customers by 10 July after attackers briefly accessed a separately stored customer file at an IT service provider and stole some of its contents. Customers in Germany, Belgium and the Netherlands were affected. The stolen information included salutations, names, email addresses, telephone numbers, dates of birth and customer numbers. Lidl said its online shop and customer accounts were not compromised, and excluded passwords, billing and delivery addresses, bank details and other payment information. The provider secured the affected systems, filed a police report and brought in forensic investigators; Lidl notified data protection authorities. Lidl said it had no concrete evidence of misuse, but warned about phishing and identity fraud. As at 3 November, no affected-customer count, provider name or final investigation outcome was found in the public sources reviewed.
- What
- Breach
- Affects
- Lidl online shop in Germany, Belgium and the Netherlands
- Fixed in
- Nothing to patch
- Since
- 10 July 2026
- Closed
- 13 July 2026
Timeline
- Update
BleepingComputer reported that customers in Germany were also affected. Lidl told the publication it had no concrete evidence of misuse and confirmed that customer accounts, passwords, addresses and payment information were unaffected.
- Update
Lidl's customer notice said the provider had restored security, reported the incident to police and engaged forensic investigators. Lidl notified the Dutch data protection authority and warned customers about phishing and identity fraud.
- Made publicNothing to patch
Lidl warned online shop customers in the Netherlands and Belgium that attackers had stolen personal information from a separate file held by an IT service provider.
Sources
- Belangrijke informatie over de beveiliging van jouw gegevens bij LidlLidl · 10 July 2026
- Informations importantes concernant la sécurité de vos données chez LidlLidl · 10 July 2026
- Hackers stelen data van Nederlandse en Belgische klanten Lidl-webshop - updateTweakers · 10 July 2026
- Hacker-Angriff bei Lidl: Discounter von Datendiebstahl betroffenteltarif.de · 10 July 2026
- Lidl discloses online shop breach after service provider hackBleepingComputer · 13 July 2026