Ahold Delhaize, the Dutch-Belgian group that runs about 9,400 stores, has confirmed a "cybersecurity incident" inside its network and taken some systems offline to contain it. The group employs nearly 400,000 people and reported more than $104 billion in 2024 net sales, according to BleepingComputer. It disclosed the incident in a press release from its Zaandam headquarters on Monday, October 12, 2026, and issued an update on October 13. The company says stores in Europe and the United States are still open. However, websites, apps, online ordering, logistics and employee systems have been disrupted at several of its brands. No attacker has been named, and the company says it has no evidence so far that customer or employee data was taken.
What Happened
Ahold Delhaize's first statement on October 12 said only that it was "experiencing a security issue within its network" and was "taking some systems offline to help protect them." The release was published as inside information under Article 7(1) of the EU Market Abuse Regulation. Cyberpress reads that as a sign the company considers the incident potentially material to investors, and cites press reports that the share price fell after the announcement.
Reports on the timing broadly agree. Cyberpress and De Vector say Albert Heijn, Etos and Gall & Gall websites and apps have been down since Sunday evening, October 11. Reuters, as syndicated by Global Banking & Finance Review, reports that the company disclosed the "security issue" on Monday. Albert Heijn first called it an "IT incident" and later described it as a "cybersecurity incident," according to Cyberpress.
In its October 13 update, Ahold Delhaize acknowledged that its precautionary measures "have caused disruption for customers, associates and partners." It said the impact "differs per brand" and that it has begun a "controlled re-launch of certain systems." It gave no timeline for full restoration. The company says it is working with external cybersecurity experts and has engaged "the appropriate authorities."
Reported impact so far:
- Netherlands and Belgium: BleepingComputer reports that customers cannot use websites, apps or customer service at Albert Heijn, Etos and Gall & Gall, or at Delhaize in Belgium. SecurityWeek, citing local media, says deliveries and online orders were affected. Cyberpress reports that tills work in stores but personal discounts and app-linked savings schemes are paused. It adds that electronic shelf labels may still show last week's offer prices, so the price charged at the till can be higher than the shelf price.
- United States: BleepingComputer reports that Stop & Shop employees could not reach their schedules or pay stubs. It also reports a Food Lion internal memo, describing the incident as an IT outage, that warned stores "may be unable to shop, stage, or hand off orders."
- Romania: Cyberpress reports that Mega Image and Profi are operating normally. No other source confirms this.
What Was Taken
As of October 13, no data theft has been confirmed. The company's update says: "We have no evidence at this moment that customer and associate data was taken." SecurityWeek and Reuters report the same position. The company stresses that this finding is provisional because the investigation is still ongoing. De Vector notes that the statement does not rule out that data was accessed or copied.
No ransomware group has claimed the attack and no leak-site listing has appeared, according to Cyberpress. Pandromeda's headline calls the incident a "data breach," but its own reporting only repeats the company's "no evidence" statement. Defenders should treat data exposure as unknown, not ruled out. In past retail incidents, "no evidence of exfiltration" has often been revised after forensics was finished or after an extortion claim appeared.
Why It Matters
- Scale and critical supply: Ahold Delhaize serves about 60 million customers a week (BleepingComputer). Stop & Shop, Food Lion, Giant Food, Hannaford, Albert Heijn and Delhaize are major food retailers in their markets. Disruption to logistics and order fulfilment has a direct effect on food distribution.
- Containment has its own cost: Most of the visible disruption so far comes from the company's own decision to take systems offline. This shows how closely loyalty, pricing, e-commerce, workforce and logistics systems are linked in modern retail, and how far an outage spreads once they are cut off.
- Sector-wide pressure: The incident came the same weekend as a separate cyberattack in France. Reuters reports that refrigerators and freezers at hundreds of stores heated to as much as 50°C overnight, causing fires and spoiled food. SecurityWeek says it is unclear whether the two are related. Reuters reports that the Dutch National Cyber Security Centre sees "no reason to believe" there is a link. Based on the available evidence, the two should be treated as separate incidents. Even so, together they show that European grocery retail is being actively targeted.
The Attack Technique
The intrusion method is not known. The company has published no details of the attacker, initial access vector, malware or affected systems. It says further details "could compromise security measures or interfere with our response efforts." No indicators of compromise have been released.
Some observations are possible from the outside. The company isolated systems quickly across several countries and is now doing a staged, "controlled" re-launch. That pattern fits a response to suspected lateral movement or a threat to shared central infrastructure, such as identity, ERP or integration layers, rather than a problem limited to one brand. This is an inference, not a confirmed finding, and should not be read as attribution to any actor or ransomware family.
What Organizations Should Do
- Map dependencies between shared and brand systems. Find out which store, loyalty, pricing and e-commerce functions depend on central group services. Design them so that isolating one does not stop all of them.
- Write isolation runbooks before you need them. Pre-approve criteria for taking systems offline. Test whether stores can keep running tills, pricing and staff scheduling while disconnected, including manual fallbacks for shelf-price differences.
- Harden identity and remote access. Enforce phishing-resistant MFA on VPN, SSO and admin accounts. Audit help desk password-reset processes, and watch for unusual privileged activity across group domains.
- Segment IT from operational technology. The French refrigeration incident shows how damaging attacks on facility systems can be. Separate building-management, HVAC and refrigeration controllers from corporate networks, and remove direct internet exposure.
- Plan for staged restoration. Restore systems one at a time from known-good backups, check each for persistence before bringing it back, and rotate credentials before re-connecting.
- Prepare communications early. Keep templates ready for regulators, market disclosures (MAR in the EU, SEC 8-K in the US) and staff. Do not tell staff or customers that data was "not taken" until forensics supports it.
Sources: Cyberattack Prompts Grocery Giant Ahold Delhaize to ... | Retail giant Ahold Delhaize takes systems offline after cyberattack | Update on Ahold Delhaize's cybersecurity incident | Ahold Delhaize takes precautionary measures following cybersecurity... | Ahold has yet to find signs of customer-data theft — De Vector | Ahold Delhaize Data Breach: What Happened, Who's Affected Pandromeda | Ahold: No Client Data Stolen in Recent Cybersecurity Incident | Ahold Delhaize Network Security Incident Triggers Precautionary Sys...