Lindt: online shop and app member data stolen from Future Shop

1. 2026-10-17 23:02

   A vulnerability in software on Future Shop servers was exploited. Member data was taken at 00:16 on 18 October. [1] [2]

2. 2026-10-19 15:30

   Monitoring detected suspicious access. Future Shop blocked the route and addressed the vulnerability; Lindt was informed the same day. [1] [2]

3. 2026-10-21 16:00

   Lindt stopped its online shop. [2]

4. 2026-10-23

   Both companies disclosed the leak. [1] [2]

5. 2026-10-26

   Lindt force-reset affected passwords and stopped new app downloads. It said affected members would be emailed from 27 October. [2]

6. 2026-10-30

   Lindt removed duplicate counting and corrected the initial 3,147,469 records to 3,147,377. [2]

The shared shop/app records include member IDs, names, email and postal addresses, phone numbers, birth dates, genders, store and registration/login details, mailing preferences and hashed passwords. No card data is included. People who had left before acquisition, guest shoppers and delivery recipients are excluded. [2]

Future Shop explicitly distinguishes this leak from both the four-server intrusion detected on 21 October and preventive maintenance for PHP vulnerabilities. [3]

A password reset is required when the shop reopens; Lindt asks users to change reused passwords elsewhere. Already signed-in app users can still use store points, but deleting the app prevents reinstallation and sign-in until service resumes. No misuse had been found as of 29 October. [2]