5 Things to Know About the Lidl Data Breach

Lidl has notified customers in Germany, Belgium, and the Netherlands that personal data was stolen from a third-party IT service provider, not from Lidl’s own systems. The retailer, owned by Schwarz Group, closed its 2025 fiscal year as Europe’s largest retailer by sales value at €140.2 billion, with roughly 3,250 of its 12,900 global stores in Germany alone. Lidl began emailing affected customers on July 10, 2026.

Here is what you need to know as this story develops.

1. This is a vendor breach, not a Lidl systems breach

Lidl has been explicit on this point across every notice it’s published: “the online shop system itself was not affected.” The compromise happened at an external IT service provider handling a separately stored customer data file, not at Lidl’s own infrastructure.

Lidl (Schwarz Group, ~377K employees, ~12,900 stores across 32 countries) disclosed that a third-party IT service provider was breached, exposing customer names, phone numbers, emails, DOBs, and customer numbers for shoppers in Germany, Belgium, and the Netherlands — no passwords or payment data, no confirmed threat actor yet.

That distinction matters more than it might sound. It means Lidl’s own security controls weren’t the failure point here, and it means the actual scope of exposure depends entirely on what else that vendor holds, and for how many other clients, information Lidl itself may not fully control or even know.

2. What was taken, and what wasn’t

The confirmed data: salutation, first and last name, phone number, email address, date of birth, and customer number.

Explicitly not taken, according to Lidl: passwords, billing or delivery addresses, bank details, or other payment information. Customer accounts themselves were not compromised.

That’s a real distinction, not just a talking point. Comparitech’s Paul Bischoff noted in comments to IT Security Guru that the stolen data “doesn’t pose a direct threat to victims’ money or identities” in the way a financial or credential leak would. The realistic risk here is phishing built on real personal details, not account takeover or direct fraud, which is exactly what Lidl’s own advisory warns customers to watch for.

3. No attacker has claimed It, vendor still unnamed

As of writing, no threat actor has publicly claimed responsibility, and Lidl has not named the compromised IT provider or disclosed how many customers are affected.

That silence doesn’t mean this is an isolated incident. It’s the latest in a run of third-party and supply-chain breaches hitting major European and UK retailers over the past year, a list that already includes Marks & Spencer, Co-op, Louis Vuitton, Pandora, and Harrods, several tied to the Scattered Spider collective, as IT Security Guru’s coverage lays out. CybelAngel has tracked this cluster before, including in our coverage of a Scattered Spider member’s guilty plea, which documents the same May 2025 retail wave. No attribution should be assumed here without confirmation, but the pattern is the point: retailers keep discovering that their exposure runs through vendors they don’t fully control.

4. The notification channel itself Is a signal

Lidl chose to email affected customers directly rather than rely solely on a published notice. That choice is worth noting against GDPR Article 34, which specifically reserves direct communication to data subjects for breaches “likely to result in a high risk” to their rights and freedoms, a higher bar than the separate, lower-threshold requirement to simply notify a data protection authority.

To be precise about what this does and doesn’t confirm: neither Lidl nor a regulator has publicly stated that this incident was formally assessed as high-risk under Article 34. But choosing the direct-notification channel, on top of notifying the Dutch and Belgian data protection authorities, is a more serious posture than the reassuring “not affected” language in the same notice might suggest on its own.

5. What organizations should do now

If you’re a Lidl customer in the affected countries:

Treat any unexpected email, text, or call referencing your Lidl account with suspicion, even if it includes accurate personal details. Go directly to Lidl’s official site or app rather than clicking a link in a message. Don’t provide passwords, payment information, or verification codes in response to anything unsolicited.

If you’re a security or risk team watching this unfold:

This week: Review which of your own vendors hold customer PII in separately stored files outside your primary systems, the exact scenario here, and confirm you actually know what each one holds.

Within a month: Revisit vendor risk tiering for any provider with access to customer contact or identity data, not just payment systems. This incident is a reminder that “no financial data” breaches still carry real phishing and fraud risk, and still trigger regulatory notification obligations.

Structurally: Build continuous monitoring into vendor risk management rather than point-in-time assessments. CybelAngel’s Third-Party Risk Assessments service and our Every Vendor Is a Vector report go into why compliance-driven, annual-questionnaire TPRM consistently misses the vendor breaches that end up in the news, this one included.

Need assistance?

Your organization’s exposure doesn’t stop at your own perimeter. CybelAngel’s 修繕サービス and Third-Party Risk Assessments help you find out what your vendors are exposing before it reaches your customers.