Ahold Delhaize disconnects IT systems after cyberattack

Full text

Ahold Delhaize took systems offline after a cyberattack, though details remain limited

Disruptions affected employee services and customer-facing websites across multiple retail brands

Company is investigating the incident amid concerns of another major ransomware-related attack

Ahold Delhaize has suffered a cyberattack that forced it to pull parts of its IT network offline.

On October 12, 2026, the retail giant issued a brief statement, saying it is experiencing a “security issue” within its network. “Our teams are taking steps to assess and mitigate the issue,” it said. “This includes taking some systems offline to help protect them. At this time, our stores are open and serving customers.”

We don’t know which parts of the operation were affected, how the attack took place, and whether or not any sensitive company or customer data was exposed. We don’t know if customers were affected, how many, and to what extent.

Usually, when a company shuts down its network to contain an incident, it is due to a ransomware attack and its data exfiltration efforts. However, no threat actors have yet claimed responsibility for this attack, and no data has surfaced on the dark web, at press time.

“Protecting our infrastructure in the best interest of our customers, associates and partners is a top priority,” the company concluded. “We apologize for any inconvenience this issue may have caused customers and partners.”

Hackers get ahold of Delhaize

Ahold Delhaize is a wholesale company and a multinational retailer running more than 9,400 stores across the United States, Europe, and Indonesia.

It counts roughly 400,000 employees, which serve some 60 million customers weekly, both in stores, and online. Brands under its umbrella include Delhaize, Maxi, Mega Image, Albert, bol, Alfa Beta, Etos, Gall & Gall, and Profi in Europe, and Food Lion, Stop & Shop, Giant Food, and Hannaford in the American market, as per BleepingComputer.

Unfortunately, it has plenty of experience with cyberattacks. In mid-November 2024, an attack on the company resulted in grocery stores and pharmacies in the US being unable to service their customers properly. Even then, Ahold Delhaize shut down parts of its network to contain the attack and had trouble with disabled phone lines. It was later confirmed that it was a ransomware attack launched by the INC Ransom threat actor.

In the attack, the hackers stole sensitive data on more than 2.2 million people , the company later confirmed via a filing with the Maine Attorney General’s Office. It said the data may have included internal employment records for both current and former employees.

The combination of stolen data varied from person to person, but generally, it included full names, postal addresses, email addresses, phone numbers, dates of birth, government-issued ID numbers, bank account numbers, health information, and other employment-related information.

Trouble for the retailers

That attack, which apparently took more than a week to remedy, was disruptive enough to have employees voicing their annoyance on social media. At one point, the pharmacy at Stop & Shop could not refill prescriptions. The Food Lion, on the other hand, had to address missing and delayed deliveries. Instacart orders return dates were constantly being pushed back.

BleepingComputer noted employees at the Stop & Shop American regional supermarket chain are now having trouble accessing their schedules and pay stubs as a direct consequence of the latest attack. Customers have been unable to use websites, apps, and customer service platforms at Albert Heijn, Etos, and Gall & Gall stores in the Netherlands, and Delhaize in Belgium.

The publication also reported, citing an internal memo shared by Lion Food employees in the United States, that the company flagged the attack as an IT outage, and told staff their “store may be unable to shop, stage, or hand off orders.”