Lidl reports a data breach at an IT vendor. Slovak customers' names, email addresses, phone numbers, and dates of birth have been compromised.
The Lidl chain has informed its Slovak customers of a security incident that occurred at one of its external IT service providers. The attack also affected some of the personal data stored by Lidl.
The leaked data includes: customers’ names, email addresses, phone numbers, and dates of birth. Billing addresses and payment information, according to the chain, were not affected.
The affected IT service provider filed a criminal complaint and commissioned forensic experts to investigate the incident. The relevant data protection supervisory authority was also informed of the situation. In addition to Slovakia, the incident affected customers in the Czech Republic, Belgium, the Netherlands, and Germany.
A Case That Serves as a Reminder for Companies
The incident once again demonstrates that security risks today are also transmitted through the supply chain—attackers do not need to gain direct access to a company; all they need is a less securely protected external IT partner. Companies that process customers’ personal data should therefore:
- regularly review the security measures of their IT suppliers,
- have an established incident reporting process (including for incidents reported by third parties),
- be prepared to fulfill their notification obligation toward data subjects and the Office for Personal Data Protection in accordance with the GDPR.
