Lidl Discloses Online Shop Customer Data Breach After Contractor Hack

The German discount chain Lidl has notified online shop customers in Germany, Belgium and the Netherlands that their personal data has been stolen by attackers.

According to the company, the breach did not stem from a direct hack of Lidl's own infrastructure, but from the compromise of a system belonging to one of the service providers that support the chain's online store.

What is known so far

Lidl has confirmed the incident and sent out notifications to affected shoppers in the three countries. The company has not disclosed the exact volume of stolen data, the nature of the compromised information, or the identity or name of the breached contractor.

Such supply-chain attacks remain a common vector for gaining access to the customer data of major retailers: attackers don't necessarily need to breach a company's own secure infrastructure — it's enough to find a vulnerability in one of its partners that has access to user data.

The company's response

Lidl stated that it had notified the affected customers in accordance with the personal data protection requirements in force in the European Union. The company did not report any additional measures it intends to take with regard to the affected service provider, nor whether law enforcement is investigating the incident.

Users who may have been affected by the breach are advised, as is generally the case in such situations, to watch out for suspicious emails and messages that could use the stolen data for phishing attacks.

Source: Bleeping Computer