Lidl has begun notifying online shop customers in Germany, Belgium and the Netherlands that their personal data was exposed after attackers breached an IT service provider used by the discount retailer. The company discovered the incident in early July 2026, and confirmed that a separately stored file containing customer data had been briefly accessed and partially copied. Lidl’s online shop system itself was not compromised; the exposure originated entirely at the third-party provider.

What was taken, and what was not

The confirmed dataset includes salutation, first and last name, telephone number, email address, date of birth and customer number for affected online shop customers. Lidl has been explicit that passwords, billing and shipping addresses, bank details and other payment information were not part of the exposed file. That distinction matters for how customers should respond: the immediate risk is not account takeover or financial fraud, but phishing and social engineering built on a plausible amount of real personal detail. Lidl notified the Dutch Data Protection Authority, published notices on its Belgian and Dutch support sites, and emailed affected customers directly, while the breached provider filed a police report and engaged forensic investigators to establish the full scope.

A retailer’s exposure runs through every vendor it trusts

This is the pattern that keeps repeating across European retail and consumer brands: the company whose name is on the breach notification is rarely the company whose systems were actually broken into. A supermarket chain the size of Lidl runs dozens, if not hundreds, of vendor integrations across logistics, marketing, loyalty programmes and e-commerce operations, and each one is a potential entry point that sits partly outside the retailer’s direct control. Under GDPR, that does not reduce Lidl’s accountability as data controller, and it should not reduce any organisation’s sense of ownership over data it hands to a processor. Regulators, and increasingly customers, expect the controller to have done real due diligence on how a processor stores, segregates and protects the data it was trusted with.

What this means if you run customer data through third parties

If your business, in Europe or anywhere else, shares customer data with fulfilment providers, marketing platforms, support tools or any other processor, this incident is a useful prompt to check three things. First, whether your data processing agreements actually specify how customer data must be stored and segmented at the processor, not just that GDPR applies in general terms. Second, whether you know which of your vendors hold a copy of your customer file separately from your production systems, since that is exactly the kind of side-stored file that was compromised here. Third, whether your incident response plan covers a breach notification arriving from a vendor rather than from your own monitoring, since that is often how these incidents are first discovered.

If you want help auditing your vendor data flows, tightening your data processing agreements, or building a response plan that covers breaches originating outside your own infrastructure, contact Excello Digital. We help European businesses turn GDPR obligations toward third parties into something they can actually verify, rather than something they simply assume.