European supermarket chain Lidl is in the news for a data breach. Reports suggest that that the company has published a breach warning online in NL, BE, and DE - but good luck spotting it if you're just a regular user. (As a challenge, see if you can spot the link to the notification on the main DE site, shown below. Hint: that's not where they published it :-) Early reports suggest that the breach affects online shoppers (so if you went into a shop and bought items directly off the shelves, whether you paid by cash or card, it sounds as though you're OK), and happened at a third-party service provider with whom a selection of Lidl's data was shared. According Lidl's official report, the stolen data definitely includes at least name, email address, phone number, birthdate, and customer number. Lidl's own notification says words to the effect that "at this point," the company is ruling out that passwords, physical addresses, bank details and other payment information were stolen. (For example, in Dutch, the phrase used is "op dit moment"; in French, it is "pour le moment.") But, as Bleeping Computer suggested earlier today, further investigation might rule it back in, because this is not quite the same as saying "we are already permanently certain that this did not happen." Watch this space, and if you're a Lidl online customer with a Lidl account, be doubly careful of emails, DMs or other messages that offer to "help" you to secure yourself in the aftermath of this breach. In particular, don't take any action based on phone numbers, links, download suggestions, or other "advice articles" sent to you, because they could have come from anywhere. Use official links or contact details you obtained well before the breach - from existing invoices, for example, or from printed correspondence. Remember, too, that search engines and AI agents can be tricked by sponsorship or lured by fake content into recommending bogus links. Even if those links weren't deliberately crafted by scammers in advance, criminals regularly look out for "hallucinated" links that they can register in the hope of catching out well-meaning internet users, in a type of online treachery known in the jargon by the memorable name of *slopsquatting*.