On 13 July 2026, BleepingComputer reported that Lidl had emailed online shop customers in Germany, Belgium and the Netherlands about a breach at a service provider. Lidl said "unknown individuals briefly gained access to a separately stored file containing customer data." The provider was not named.
What's affected
Per Lidl's notice as reported by BleepingComputer:
- Exposed: salutation, first and last name, telephone number, email address, date of birth and customer number.
- Not affected, according to Lidl: passwords, payment information, billing and shipping addresses and bank details. Lidl said customer accounts were not compromised and the online shop's own system was not affected.
- Lidl said it has no concrete evidence of misuse and warned customers about phishing and identity misuse.
- Lidl notified the Dutch Data Protection Authority. The provider filed a police report and hired forensic experts.
The reports do not say how the file was reached, so this post does not guess.
What to do now
- List every file, export or report you have given a service provider that contains customer identifiers, such as a nightly CSV for a marketing or support tool.
- Ask each provider where those files are stored, who can read them and when they are deleted.
- Remove fields the provider does not need. Date of birth is rarely needed for a campaign tool.
- Draft the customer wording now. Lidl's notice names what was and was not exposed, which is the standard to match.
How this could have been avoided
- Do not send standing exports. Replace a stored file with a scoped API call that returns only what a task needs.
- Minimize the fields. A customer number and email are enough for most vendor jobs, and a date of birth turns a nuisance leak into an identity-risk leak.
- Set deletion dates on files held by providers, and verify them.
- Contract for storage controls: encryption at rest, access logging and a named breach notification window.
Quick check
Why does a "separately stored file" matter to a company whose own shop was not hacked?
The file held the company's customers' data. Where it is stored does not change who the data belongs to, or who must notify customers and the regulator.
