Key point: Attack through an IT service provider demonstrates that even large retail chains are vulnerable to weak supplier security.
Retail group Lidl confirmed a security incident at an IT service provider, through which customer data from the Lidl online shop was exposed. Affected customers were notified by email.
Unknown attackers gained access to customer data from the Lidl shop via an IT service provider. Lidl did not specify the exact scope of compromised data or the number of affected customers. The attack illustrates the risk of supplier dependencies in IT security: third-party providers with access to critical systems can become an entry point if their own security does not match the security level of the organization.
Lidl informed those affected via email about the incident. In doing so, the company complied with the regulatory obligation to notify in the event of a data breach. Such supply-chain attacks are relevant for CISOs as they show that even companies with established security standards can be compromised through service providers. Under the NIS2 Directive, securing the supplier ecosystem will become increasingly important.
The incident underscores the need for a strict vendor risk management strategy, including regular audits of service providers and clearly contractually agreed security requirements. Organizations should examine which of their service providers have access to sensitive customer data and continuously validate their security practices.
Source: www.golem.de · Published July 13, 2026
Lumi AI News — AI-assisted curation in accordance with Article 50 EU AI Act. Paraphrase and classification by Lumi News Pipeline v1.7.3.