Ahold Delhaize Cyberattack Hits Stores in US and Europe

Ahold Delhaize has confirmed that the cyberattack it disclosed on October 12 disrupted services at stores across Europe and the United States. Brand websites, mobile apps and customer service platforms stayed offline for more than a week. The group runs 9,551 stores and serves 77 million customers a week, so even a partial outage reaches a vast number of shoppers.

Physical stores stayed open to customers throughout, so the damage from the Ahold Delhaize cyberattack landed on digital services instead. Online ordering, home delivery and several internal employee systems stopped working. Recovery is now moving faster in Europe than in the United States, where e-commerce across the company’s American brands remains down.

How the Ahold Delhaize Cyberattack Reached Store Shelves

Across the Netherlands, the cyberattack left Ahold Delhaize customers locked out of websites, apps and customer service platforms. Albert Heijn, Etos and Gall & Gall all went dark, and shoppers at Delhaize in Belgium hit the same wall. In the United States, Stop & Shop employees reported losing access to their schedules and pay stubs. An internal Food Lion memo warned that stores might be unable to stage or hand off online orders.

Dutch customers also reported incorrect shelf pricing and cancelled home deliveries. Those symptoms suggest the cyberattack on Ahold Delhaize reached operational systems, not just public-facing web services. Pricing feeds, order management and workforce scheduling all run through central infrastructure. Pulling that infrastructure offline has consequences at store level within hours.

Most store websites and apps across Central and Southeastern Europe came back first. Albert Heijn has restored its website and app, and home deliveries resume on Friday, October 23. Etos and Gall & Gall are live again, while Belgian e-commerce now runs at full capacity. The American brands are still waiting, with no firm date beyond “the coming days.”

Why the Company Took Its Own Systems Offline

Ahold Delhaize said its teams took some systems offline to protect them when it first disclosed the cyberattack. That move is standard containment practice. Isolating network segments stops attackers moving laterally, and it keeps ransomware out of systems that remain clean.

The cost of that decision lands fast and lands visibly. A retailer this size loses online revenue, delivery capacity and payroll access the moment central systems go dark. Security teams accept the price because the alternative is worse. An intruder left loose inside a network spanning two continents can turn a contained incident into full-scale encryption.

The length of the outage tells its own story. Restoring systems across four countries and more than a dozen brands took over a week. Parts of the estate are still down, which points to deep infrastructure involvement rather than one compromised application.

Regulators and Police Notified Within 24 Hours

Ahold Delhaize notified the Dutch National Cyber Security Centre within 24 hours of discovering the cyberattack on its network. It has kept the NCSC, law enforcement and other regulators updated since. This week it also filed a formal police report with Dutch police.

That timeline matters under NIS2, which gives essential entities a 24-hour window for an initial notification. Large retail groups fall inside scope in several member states. The regulatory handling of the Ahold Delhaize cyberattack offers a clean example of hitting that deadline mid-incident.

Filing a police report carries practical weight too. It formalises the criminal investigation, supports insurance claims, and creates a documented record for regulators and shareholders. It also puts the company on record as a victim if stolen data surfaces later.

What the Company Has Not Said

The company has not confirmed if attackers encrypted any devices, and it has not named an initial access vector. A spokesperson pointed back to the published statement when asked about encryption and affected systems. No ransomware group has claimed the Ahold Delhaize cyberattack so far.

The ongoing investigation into the Ahold Delhaize cyberattack has not found evidence of stolen customer, associate or partner data. That finding remains interim. Forensic teams often surface proof of exfiltration weeks into a review, so an early all-clear carries limited weight.

Frans Muller, president and CEO, apologised for the disruption and attributed it to the malicious actions of others. The company has otherwise declined to share detail that could interfere with its response.

A Second Major Incident in Two Years

This marks the second serious security event to hit the group in two years. In November 2024, the ransomware operation INC Ransom breached Ahold Delhaize USA systems. The group stole personal, financial and health information belonging to more than 2.2 million people, and the company confirmed the theft after INC Ransom listed it on a leak site.

INC Ransom has run as a ransomware-as-a-service platform since mid-2023, hitting healthcare, education and government targets. Researchers link it closely to the Lynx operation that surfaced a year later. Nobody has connected either group to the Ahold Delhaize cyberattack disclosed this month.

Repeat targeting of one corporate group still raises uncomfortable questions. Attackers trade reconnaissance, and a company that proved breachable once draws renewed interest. Hardening after 2024 centred on US systems, while this attack spread across European operations as well.

Why Food Retail Keeps Drawing Attacks

Grocery chains sit in an awkward position for defenders. Margins run thin, store networks are enormous, and the model depends on central systems for pricing, inventory, scheduling and fulfilment. Attackers understand that downtime costs money by the hour, which hands them leverage in any extortion negotiation.

The sector has produced a steady run of incidents over the past two years. European grocery brands have dealt with supplier-side breaches, and ransomware has halted production at food manufacturers. One French chain even lost refrigeration control during an attack. The Ahold Delhaize cyberattack fits that pattern, where corporate IT and operational systems sitclose together.

Retailers also carry heavy third-party exposure through loyalty platforms, payment processors, logistics partners and scheduling vendors. Each of those connections holds network access or customer data, and each one widens the attack surface.

What Comes Next

Ahold Delhaize still has work ahead before American e-commerce returns and the investigation closes. Attribution may follow if a ransomware group posts a claim. The silence so far leaves room for a different motive or a failed extortion attempt, and regulatory filings will eventually fill some of the gaps.

For businesses watching from outside, the practical lesson sits in the response rather than the breach. On current evidence, fast isolation and same-day regulator notification kept the Ahold Delhaize cyberattack an operational problem rather than a data one. Companies running large distributed estates should test how fast they could make the same call. Taking critical systems offline only works when the team has rehearsed the recovery path behind it.