Notebooksbilliger, one of Germany's largest online electronics retailers, has reported a cyberattack and says customer data may have been affected, according to Golem. The company has notified the relevant authorities; the scope — which data, how many customers, and whether payment details are involved — has not been made public.
For customers, the practical risk after a retail breach is rarely the stolen record itself and usually what follows it: phishing mail that quotes an order number, calls that reference a delivery, or credential stuffing against a password reused on other sites. The defensive response is the same whether or not the leak is confirmed:
- Treat unexpected mail about orders, invoices or deliveries as suspect, and open the shop by typing its address rather than clicking a link. - Change the account password if it is reused anywhere else, and enable two-factor authentication where it is offered. - Watch bank and card statements for small test charges.
Under the EU's GDPR, an organisation that suffers a personal-data breach must notify the supervisory authority within 72 hours of becoming aware of it, and must inform affected individuals without undue delay when the breach poses a high risk to their rights and freedoms. That two-step obligation explains the shape of these announcements: an initial, deliberately vague statement while forensics run, followed by individual notices if the risk is judged high enough.
The incident lands in a period in which attacks on customer databases at European retailers have become routine rather than remarkable. For shoppers the sober conclusion is that the breach notice — and the password they reused — matter more than the brand involved.
Note: details of the attack's extent are not yet fully public. The basis here is Golem's report.
