Lidl, the German discount chain owned by Schwarz Group, has notified customers in Germany, Belgium, and the Netherlands that attackers stole personal data in a breach at a service provider. Exposed information includes names, phone numbers, email addresses, dates of birth, and customer numbers from Lidl's online shop. The company says the shop's own systems were not affected and that passwords, payment details, and addresses were not compromised. Lidl notified the Dutch Data Protection Authority and warned customers of potential phishing.

The incident reflects a persistent gap in enterprise security: third-party risk. Lidl's systems held up, but data entrusted to a provider did not — a distinction that matters little to customers or to regulators under GDPR. Retail environments depend on a web of external processors, marketing platforms, and cloud services, each holding customer data outside the retailer's direct visibility. When a breach hits that layer, the victim often learns of it late and struggles to determine scope, because the relevant access logs, flows, and egress traffic sit in someone else's environment.

Reducing this exposure requires visibility across vendor connections and data leaving the enterprise, not just the perimeter. Effective controls include baselining of data transferred to third-party processors, behavioral analytics on API and integration activity, encryption and tokenization so exported data is unusable if stolen, and packet-level capture with long retention for forensic scoping. Unified platforms like NIKSUN — which consolidate packets, flows, logs, events, and threat intelligence into a single data lake with AI-driven analytics and forensics — give security teams the context needed to see what customer data leaves their environment, where it goes, and what happens to it when a partner is compromised. Read more about this story on our LinkedIn page