Ahold Delhaize, the Dutch parent of grocery chains including Food Lion, Stop & Shop, Hannaford, Giant Food, and Albert Heijn, confirmed on October 19 that suspicious activity detected across its IT systems the previous week was the result of “malicious actions of others.” The confirmation turns a week of unexplained website and app outages into a formally acknowledged cyberattack, and the company has filed a police report in the Netherlands.
What Happened
Ahold Delhaize detected the suspicious activity on October 12 and responded by taking systems offline as a precaution across most of its brands in the United States and Europe — a decision CEO Frans Muller has since called “the right decision.” The shutdown knocked out e-commerce and delivery ordering for Food Lion, Stop & Shop, Hannaford, and Giant Food in the US, and disrupted online services for Albert Heijn, Etos, Gall & Gall, and Delhaize in the Netherlands and Belgium. Physical stores stayed open throughout, though several struggled with supply shortages as distribution systems were also affected.
Recovery has been staggered by brand and geography. Albert Heijn’s website returned Monday but its online deliveries — about 10% of the chain’s sales — were not expected back until Thursday at the earliest, extending that disruption past 11 days. Belgium’s Delhaize restored e-commerce over the preceding weekend. In the US, Food Lion and Stop & Shop online ordering remained down as of the confirmation, with the company saying only that service would resume “in the coming days.”
The company notified the Dutch National Cyber Security Centre within 24 hours of detection and filed a formal police report on October 19. It says it currently has no evidence that customer, employee, or partner data was stolen, but stresses the investigation is ongoing. Ahold Delhaize has declined to describe the nature of the attack, state whether a ransom demand was involved, or attribute it to any actor, saying it is “not sharing further details that could compromise security measures or interfere with our response efforts.” Dutch authorities noted no evidence linking the incident to an unrelated attack on French supermarket refrigeration systems that occurred the same weekend.
Why It Matters
Ahold Delhaize operates roughly 9,000 stores across the US and Europe and sits squarely in the food and agriculture critical infrastructure sector. A multi-day, multi-country disruption to e-commerce, delivery, and distribution systems at this scale demonstrates how a single intrusion at a grocery conglomerate’s shared back-office infrastructure can cascade into consumer-facing supply disruption across two continents simultaneously. This is also the second major cyber incident to hit Ahold Delhaize’s US operations in two years: a November 2024 attack, later claimed by the Inc Ransom group, exposed data on more than 2.2 million people and disrupted pharmacies and deliveries for weeks. Whether this incident shares a cause, actor, or initial-access vector with that earlier breach is not yet known.
Recommended Actions
- Retailers and distributors should treat e-commerce, loyalty, and electronic-shelf-labeling platforms as potential single points of cascading failure and maintain tested manual fallback procedures for in-store pricing and payment.
- Organizations with EU operations should review breach-notification obligations to national cyber authorities and data protection regulators given the ongoing, unresolved data-impact assessment.
- Sector peers should monitor for indicators of compromise or advisories as Ahold Delhaize’s investigation progresses, particularly any later confirmation of ransomware involvement or data exfiltration.
- Food and agriculture sector organizations should review third-party and shared-services exposure across multinational banners, since centralized IT serving dozens of retail brands multiplies the blast radius of a single compromise.