Ahold Delhaize Hit by Cyberattack: Albert Heijn, Food Lion, and Stop & Shop Disrupted

Ahold Delhaize confirms a cybersecurity incident across two continents

Grocery giant Ahold Delhaize confirmed on October 19 that it is dealing with a cybersecurity incident that disrupted operations across its European and US brands. In the Netherlands, Albert Heijn, Etos, and Gall & Gall saw digital services and business operations hit. In the US, Food Lion, Stop & Shop, Giant Food, The Giant Company, and Hannaford suffered website and app outages. In Belgium, Delhaize faced operational disruption, with deliveries resuming over the weekend.

Physical stores stayed open, but the back end didn't: distribution systems and e-commerce were the casualties, and US online grocery services were still disrupted as of the October 19 update. The company says it has no evidence that customer, employee, or partner data was stolen.

That last line is doing a lot of work, and it deserves scrutiny.

What we know — and what we don't

Ahold Delhaize has not identified the threat actor, disclosed the initial access method, or confirmed ransomware. No connection has been established to the separate cyberattack affecting French supermarkets in the same period. The investigation is ongoing, and systems are being restored in stages.

"No evidence of data theft" is the standard holding line in the first 72 hours of an incident. It means the forensics team hasn't found exfiltration yet — not that it didn't happen. History is full of breaches where the "no evidence" statement aged badly within weeks. The honest read: it's too early to know either way.

The operational pattern — simultaneous disruption of e-commerce, websites, and distribution across brands in two continents — suggests the attackers got into shared corporate infrastructure rather than a single store system. That's the same shape as the ConnectWise supply-chain attack that walked straight into Microsoft 365: hit the platform everyone shares, and you hit everyone at once.

Why grocery chains keep getting hit

Retailers are attractive targets for a simple reason: they run on thin margins and can't afford downtime. A supermarket chain that can't process online orders or restock shelves bleeds money by the hour, which makes the ransom math compelling for attackers. Add sprawling franchise and partner networks, legacy point-of-sale systems, and e-commerce platforms bolted onto decades-old logistics — and you have a large attack surface with a low tolerance for outages.

Ahold Delhaize is one of the world's largest food retailers, which makes the incident a useful stress test for the sector. If a company of this size, with this much security budget, can lose e-commerce across two continents for days, smaller chains should be asking hard questions about their own incident response plans.

What shoppers should do

For now, the practical advice is limited but real. If you shop at any affected brand, watch for the official breach-notification emails — and verify them independently rather than clicking links in them, since attackers love to phish during the confusion of a real incident. Our guide on what to do after a data breach covers the full checklist, from password changes to credit freezes. The Burger King Japan breach earlier this month showed how fast customer data can move once it's out — 11 million records, disclosed within days.

Ahold Delhaize says some digital services have returned and recovery continues. The bigger question — whether customer data was touched — won't be answered until the forensics are done. Watch this space.

Details of the Ahold Delhaize cyberattack remain limited while the investigation continues, and the company has not given a timeline for full restoration. For a retailer of this size, every day of disrupted e-commerce is measured in millions - which is precisely why these incidents keep happening.