Cyberattack forces Ahold Delhaize to take systems offline, disrupting grocery brands across the US and Europe

TLDR

• Ahold Delhaize took systems offline on 12 October after a cybersecurity incident, disrupting grocery brands in three countries.¹
• One incident disrupted deliveries, pricing and customer service across two continents, with no attacker or data theft confirmed.¹²
• It began a "controlled re-launch" on 13 October, and no link to the French refrigeration attack is confirmed.²³

Ahold Delhaize, which operates across nine countries and employs more than 400,000 people, said its teams began taking precautionary measures, including disconnecting some systems, after detecting the incident on its network.¹ In the Netherlands, the outage disrupted Albert Heijn's website, app and customer service, suspended grocery deliveries, and left electronic shelf labels showing outdated prices from Sunday afternoon onwards; in Belgium, Delhaize customers could not place new orders, though its website and app stayed accessible.¹ In the US, Food Lion and Stop & Shop customers reported outages and delayed deliveries on social media, with staff describing it internally as an IT outage.¹

The company's own newsroom update on 13 October said its investigation was ongoing and that it was not disclosing further technical detail "that could compromise security measures or interfere with our response efforts," while confirming it had found no evidence of stolen customer or associate data at that point.² Ahold Delhaize suffered a prior ransomware attack in November 2024, later claimed by the INC Ransom group, which it disclosed to US regulators in June 2025 had compromised the personal data of more than 2.2 million people.¹ SecurityWeek noted it remains unclear whether this new incident is connected to a separate cyberattack disclosed the same week that disabled refrigeration controllers at hundreds of French supermarkets.³

Why it matters: a single cybersecurity incident at one of the world's largest grocery retailers was enough to disrupt deliveries, pricing and customer service simultaneously across two continents, even before any data theft or attacker has been confirmed.

Update, 20 October 2026: In a newsroom update on 19 October, Ahold Delhaize said its investigation had confirmed that the suspicious activity "resulted from the malicious actions of others", that it had notified the Dutch National Cyber Security Centre within 24 hours of discovery, and that it filed a formal police report with the Dutch police that day.⁴ The company still says it has no evidence that any sensitive customer, associate or partner data was taken, and it is withholding further detail on the attack because the investigation is ongoing.⁴ The Record notes the company did not describe the nature of the attack or say whether a ransom was involved, and no threat actor has been named.⁵

On restoration, the company says Albert Heijn's website and app are back online with home deliveries expected to resume from Friday 23 October, the Etos and Gall & Gall websites are available, e-commerce in Belgium is fully operational, and the majority of websites and apps in Central and Southeastern Europe are available.⁴ E-commerce at its US brands is expected to return "in the coming days"; The Record reports online shopping at US brands including Food Lion and Stop & Shop was not yet working on 19 October, and all stores stayed open throughout.⁴⁵ The Register says Ahold Delhaize did not immediately answer whether the incident is linked to the attacks on refrigeration controllers at French supermarkets that began on 11 October.⁶ The Register and The Record both note this is the company's second major cyber incident in two years, after the November 2024 attack claimed by INC Ransom.⁵⁶