Hackers steal Lidl customer data from external service provider

### Executive summary Lidl disclosed a data breach involving a third-party IT service provider that resulted in the brief unauthorized access and exfiltration of a customer database for Germany, Belgium and the Netherlands; exposed data reportedly includes customer names, titles, phone numbers, email addresses, dates of birth and customer numbers, while passwords and payment information appear unaffected. Lidl has notified authorities, filed a criminal complaint, and warned customers to watch for phishing or identity-theft attempts, but has not identified the provider, quantified affected customers, or attributed the incident to a threat actor.