Lidl Confirms Data Breach

If you’ve ever shopped at Lidl’s online store, you may have received an unpleasant message in your email this week. The chain confirmed that attackers had accessed a file of customer data from one of its external IT suppliers, which included names, phone numbers, emails and dates of birth. And Lidl wasn’t alone this week the data was also leaked to consulting giant Accenture.

Lidl has confirmed a security incident affecting customers of its online store. According to the company, unknown attackers briefly gained access to a separately stored file containing customer data at one of Lidl’s IT service providers and managed to steal part of it.

Lidl emphasized that the e-shop system itself was not compromised — the incident occurred at an external IT service provider, not directly within Lidl’s own infrastructure. Customers began receiving warning emails on July 10, and according to available information, the breach affects not only the Czech Republic but also other European markets, including Germany, the Netherlands, and Poland — reflecting the fact that Lidl’s online store shares infrastructure across its European branches within the Schwarz Group.

The stolen data includes salutations, first and last names, phone numbers, email addresses, dates of birth, and customer numbers. Lidl also clearly stated what was not at risk: passwords, billing and delivery addresses, and banking details. This data remained secure, and customer accounts themselves were not compromised.

According to Lidl, the company currently has no concrete evidence that the stolen data has actually been misused. Nevertheless, it is preemptively warning customers about the risks of phishing emails, fraudulent phone calls or messages, and identity theft attempts that could exploit the leaked contact details.

Spokespersons for Lidl Czech Republic, Veronika Nová and Iveta Barabášová, confirmed the incident to the media and stated that affected customers were informed directly by email.

Test your system before hackers do!

Every week we bring examples of attacks and vulnerabilities that can affect anyone. If you’re not sure whether your infrastructure is resilient, we’d be glad to help you find out. At SysNetShield we offer vulnerability scanning, penetration testing, Red Teaming, and phishing campaign simulations.

Get in touch — the first consultation or a vulnerability scan of a single domain/IP address is free.

Accenture Confirms Data Breach

Lidl was not the only company to suffer a data leak this week. Accenture confirmed a security incident after an attacker operating under the alias “888” published an offer claiming to have stolen roughly 35 gigabytes of internal data from the company.

According to a forum post from July 6, the attack took place in early July, and the stolen data allegedly included source code, RSA and SSH keys, Azure Personal Access Tokens, Azure Storage access keys, and configuration files. To support the claim, the attacker published a screenshot purportedly showing the cloning of an Azure DevOps repository named “121123_AtriasTalentAcademy”, hosted on a partially redacted production address of the accenture.com domain.

According to available information, Accenture’s initial public response was rather evasive, but the following day the company confirmed that a security incident had indeed occurred. A company spokesperson told several media outlets, including SecurityWeek and BleepingComputer, that it was an isolated case and that the incident had no impact on Accenture’s operations or service delivery.

However, this confirmation only concerns the fact that an incident took place — the company has not yet verified the attacker’s specific claims about the volume or type of stolen data, has not disclosed how the breach occurred, and has not stated whether client data or personal information was affected.

What worries security experts most is the nature of the allegedly leaked data. Unlike a typical leak of customer records, as was the case with Lidl, the combination of source code, cloud credentials, and cryptographic keys could give attackers a kind of map of Accenture’s internal systems, allowing them to search for hardcoded passwords, weaknesses in the code, or a path into the environments of the company’s many corporate clients.

This is not the first time the “888” alias has targeted Accenture, nor the company’s first serious security incident. In 2024, the same attacker attempted to sell data linked to Accenture’s internal tool “Media Exchange”, which the company dismissed at the time, stating that only three people were actually affected.

These cases fit into this year’s trend of attackers increasingly targeting external IT vendors and service providers rather than companies’ core systems.

Ubiquiti Patches Critical Flaws Across the Entire UniFi Ecosystem

On July 2, Ubiquiti published Security Advisory Bulletin 066, addressing a wide range of security flaws across the UniFi product line. The bulletin covers the UniFi Connect, UniFi Talk, UniFi Access, UniFi Protect, and UniFi Network Application software, as well as the UniFi OS platform itself, which powers gateways and consoles such as the UDM, UNVR, and UNAS. In total, the bulletin contains 25 security vulnerabilities across the UniFi ecosystem.

The most dangerous flaw is CVE-2026–50746 in the UniFi Connect application, which received the maximum CVSS score of 10.0. It is an access control flaw that allows an attacker with network access to execute commands without any authentication.

Close behind are CVE-2026–50747 (CVSS 9.9), a chain of authenticated SQL injection vulnerabilities in UniFi Talk enabling privilege escalation, and CVE-2026–50748 (CVSS 9.9), an input validation flaw in UniFi Access.

Beyond these headline issues, the bulletin also contains other notable flaws. Researchers highlighted a path traversal vulnerability in UniFi OS that can completely bypass authentication. UniFi Protect also suffers from authentication bypass issues in its API endpoints and video streaming, plus an SQL injection flaw.

Ubiquiti states that it has no evidence that these newly disclosed flaws have been exploited in the wild, and it offers a patched version for every affected product.

16-Year-Old Linux KVM Flaw Allows Guest VM Escape to the Host

A newly disclosed vulnerability nicknamed Januscape, tracked as CVE-2026–53359, shows just how long a serious flaw can remain hidden in critical infrastructure.

Security researcher Hyunwoo Kim discovered a use-after-free flaw in the shadow MMU code of the KVM hypervisor in Linux — code shared by both the Intel and AMD x86 implementations. According to Kim, it is the first publicly known guest-to-host escape that works on both platforms, and the flaw itself has apparently been lurking unnoticed in the kernel since around 2010.

Technically, the problem lies in how KVM manages so-called “shadow pages”, which it uses to map the memory layout of a guest VM. When KVM needs such a page, it checks whether it can reuse an existing one. However, a faulty check compared pages only by their memory address (gfn) and ignored their role, so two structurally different types of pages could be swapped. This mix-up corrupts KVM’s internal bookkeeping. In most cases, the kernel detects the inconsistency and deliberately crashes to protect itself. That is exactly what the publicly available proof-of-concept does: a malicious guest can bring down the entire host server, and with it all other VMs on the same machine. In a rarer and more dangerous scenario, the freed page is allocated for another purpose before cleanup takes place, resulting in a write to memory the kernel no longer owns. According to Kim, this limited access can be built up into full code execution on the host, although this exploit has not been published yet.

Januscape marks Kim’s third Linux kernel flaw disclosure in roughly two months, following Dirty Frag and ITScape.

The fix was written by KVM maintainer Paolo Bonzini and adds a single line of validation, ensuring that a shadow page is reused only if both its memory address and its role match.

Progress Urges ShareFile Customers to Shut Down Servers Immediately

On July 10, Progress Software sent an urgent warning titled “Service Disruption. Immediate Action Required” to customers running on-premises ShareFile Storage Zone Controllers. The company said it had identified an “external security threat” targeting these systems and, as a precautionary measure, had already deactivated cloud access for affected accounts.

Importantly, Progress also told customers that disconnecting from the cloud alone is not enough. Administrators must manually shut down the Windows servers running the Storage Zone Controllers. The ShareFile status page now confirms that customers with Storage Zone Controllers are “out of service” while the investigation is ongoing.

Storage Zone Controllers are the on-premises component of a hybrid ShareFile deployment. They allow organizations to keep files on their own storage while still relying on the ShareFile cloud for authentication, sharing, and account management. Because these controllers broker file transfers between the cloud and internal storage, they are typically exposed to the internet, which makes them an attractive target and explains why Progress opted for a complete shutdown rather than simply instructing customers to install a patch.

The company says that at this time it has no evidence of unauthorized access to accounts or data and that it is working with internal and external security experts.