Lidl Data Breach Affects Customers in Three Countries

What Happened

International retail giant Lidl has confirmed a data breach affecting customers of its online shop in Germany, Belgium, and the Netherlands. In a statement last week, the company clarified that the cyberattack did not target its own systems directly but rather an external IT service provider it uses. The incident was reportedly discovered at the beginning of last week, and the process of informing affected customers was initiated immediately.

Lidl, part of the Schwarz Group, published detailed notifications regarding the incident on its customer service websites in Belgium and the Netherlands. These announcements stated that despite the company's high IT security standards, attackers were briefly able to access a separately stored file containing customer data and steal a portion of it. The company emphasized that this incident did not affect the general operation or security of the online shop system, highlighting it as an isolated event. Such third-party breaches represent a growing risk for companies in today's complex digital ecosystem. No matter how strong a company's own security measures are, a weak link in the security chain of its partners and suppliers can compromise the entire system. This event serves as another indicator of how critical supply chain security has become.

Data Compromised

According to official statements from Lidl, the data compromised by the cyberattackers includes highly sensitive personal information. The following details of affected customers were exposed:

• Salutation (Mr./Ms.)
• First and Last Name
• Phone Number
• Email Address
• Date of Birth
• Customer Number

The combination of this data set constitutes a valuable resource for cybercriminals. Information like name, surname, email, and phone number can be used for direct targeted phishing attacks. The date of birth can play a key role in identity theft and social engineering attempts. Attackers can use this information to impersonate customers, open fraudulent accounts in their names, or orchestrate more complex fraud scenarios.

However, Lidl provided a crucial assurance regarding the scope of the breach. The company stated unequivocally that its investigations confirmed the following critical data was not affected by the leak:

• Passwords
• Billing and Delivery Addresses
• Payment Information, such as Bank Details or Credit Card Numbers

This means that customer accounts were not directly compromised, and there is no immediate risk of financial loss. The security of customer accounts and the fact that payment information was not leaked significantly limit the potential damage of the incident. Nevertheless, the risk of the stolen personal data being used for fraudulent purposes in the future remains.

How the Attack Occurred

According to Lidl's statements, the attack was directed not at the company's own infrastructure but at the systems of a service provider. It is stated that attackers, "despite high IT security standards," briefly gained access to a separately stored file containing customer data. During this access, a portion of the data in the file was stolen. This explanation indicates that the attack targeted a data set independent of Lidl's main online shopping platform.

The company has not publicly shared the name of the breached IT service provider or the technical details behind the attack. Issues such as which vulnerability was exploited, who the attackers are, or how they infiltrated the system remain unclear. Typically, in such incidents, companies refrain from disclosing technical details until the investigation conducted by forensic experts is complete. The investigation aims to uncover the full scope and impact of the attack.

Who Is Affected

The data breach affected customers who used Lidl's online shops in Germany, Belgium, and the Netherlands. It was stressed that the breach does not cover customers who shop at physical stores, concerning only users of the online platform. Lidl announced that it has begun the process of notifying affected customers directly via email. Even if you live in one of these three countries and have used the Lidl online shop but have not yet received a notification email, it is advisable to remain vigilant.

The company has not provided a specific number for the total number of affected customers. However, given that it covers three major European markets, it raises the possibility that the breach may have affected tens, or even hundreds, of thousands of individuals.

What You Can Do

If you have received a notification from Lidl regarding this data breach or have used the online shop in these countries, there are some important steps you should take to protect your personal security. The stolen information can be used, in particular, for phishing and identity theft attacks.

• Be Wary of Suspicious Communications: Scammers with access to your name, email address, and phone number can send you highly convincing emails or text messages (SMS) that appear to be from Lidl. These messages may claim there is an urgent issue, your account has been suspended, or you have won a special offer, asking you to click a link or enter personal information.
• Verify the Sender: To determine if an email is genuinely from Lidl, carefully check the sender's email address. Scammers often use fake addresses that look very similar to the official one, like "[email protected]".
• Do Not Click Links: Do not click on any links in suspicious emails or messages. If you need to check your account, type Lidl's official website address directly into your browser yourself.
• Do Not Share Personal Information: Lidl or any other legitimate institution will not ask you for sensitive data like passwords or bank details via email or phone. Never respond to such requests.
• Report Suspicious Activity: If you receive a suspicious email or message, you can report it to Lidl. The company has shared the email addresses [email protected] for Belgium and [email protected] for the Netherlands for such situations.

What the Company Says

Lidl stated that it has followed a transparent communication policy since the incident was discovered. The announcement on the company's Belgian website said, "We are contacting you because, as a Lidl online shop customer, we wanted to inform you of an IT security incident that occurred at one of our service providers. This incident affects some of your data held by Lidl. We were informed of this incident earlier this week."

The Dutch notification used similar language, stating, "Unknown individuals have, despite high IT security standards, briefly gained access to a separately stored file containing customer data, and part of the data has been stolen from it. The online shop's system itself was not affected."

The company confirmed that, in line with its legal obligations, it had reported the situation to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). Furthermore, it was stated that the breached IT service provider had filed a police report and immediately began working with forensic IT experts to investigate the full extent of the incident. Although Lidl added that there is currently no concrete evidence of data misuse, such statements are often standard procedure and do not mean there is no future risk. Incidents like these are common in the world of cybersecurity, and it is important to stay prepared for similar risks by following the latest Data Breach News.

Source

https://securityaffairs.com/195270/data-breach/lidl-notified-online-shop-customers-in-germany-belgium-and-the-netherlands-of-a-data-breach.html