2026 Lidl — webshop third-party provider breach; names, emails, phones, DOBs (Jul)

Verified data protection incident — disclosed July 10, 2026. Lidl, the Schwarz Group discount supermarket chain, emailed affected online-shop customers in Belgium, Germany, and the Netherlands after an IT security incident at a third-party service provider enabled unauthorized access to a customer-data file. Heise and NL Times report exfiltrated fields include name, phone number, email address, date of birth, and customer number; Lidl's spokesperson told Heise postal addresses, passwords, and payment information were not affected and customer accounts were not compromised. Cybernews reviewed customer-notification language stating Lidl could not yet rule out passwords, billing or delivery addresses, bank details, or other payment information, highlighting ongoing forensic uncertainty. Lidl notified data protection authorities in Belgium, Germany, and the Netherlands, filed a police report in Germany, and engaged external security experts; the company said it had no evidence of data misuse at disclosure. Victim count had not been publicly disclosed at catalog time.