In July 2026, Lidl reported a data breach resulting from unauthorized access to a file stored by a third-party IT service provider. The breach exposed personal data of customers who used Lidl's online shop in Germany, Belgium, and the Netherlands. Although the online shop systems were not directly compromised, the attackers briefly accessed a file containing customer information such as salutation, full name, telephone number, email address, date of birth, and customer number. Lidl cannot exclude the possibility that additional sensitive data like passwords and payment details were also accessed. The service provider has engaged forensic experts and filed a police report. Lidl has informed affected customers and the Dutch Data Protection Authority and cautioned about phishing risks.

The breach resulted in unauthorized disclosure of personal customer information, including names, contact details, dates of birth, and customer numbers. There is a potential risk that more sensitive data such as passwords, billing and delivery addresses, and bank details may have been exposed, although this is not confirmed. This exposure increases the risk of phishing attacks, identity fraud, and potential misuse of personal data. No direct compromise of Lidl's online shop systems was reported.

Lidl has notified affected customers and relevant data protection authorities. Customers are advised to remain vigilant against phishing attempts and verify the authenticity of communications. The hacked service provider has involved forensic experts and filed a police report. No direct patch or fix applies as the breach originated from a third-party service provider. Organizations should monitor communications for suspicious activity but no immediate technical remediation from Lidl is indicated at this time.