Retail Giant Ahold Delhaize Takes Systems Offline After Cyberattack

Ahold Delhaize Takes Systems Offline After Cyberattack

Ahold Delhaize, one of the world's largest food retail groups and parent company of grocery chains including Albert Heijn, Delhaize, Stop & Shop, Food Lion, Giant Food, The Giant Company, and Hannaford, confirmed on October 12, 2026 that it had taken systems offline in response to a "cybersecurity incident" affecting its network. The Zaandam, Netherlands-based company said in a press statement that it is "experiencing a security issue within its network" and that its teams are "taking steps to assess and mitigate the issue," including proactively disabling some systems "to help protect them." The disruption, described internally as a large-scale IT outage, began over the preceding weekend and was still ongoing at the time of disclosure.

Ahold Delhaize stressed that physical stores remain open and able to serve customers, but the company has not named an attacker, disclosed the attack method, confirmed whether data was accessed, or given a timeline for restoring affected systems. "We cannot yet indicate when our services will be available again," the company said. Notably, the disclosure was flagged as "inside information" under the EU Market Abuse Regulation, a designation reserved for events considered material enough to potentially move the company's share price — Ahold Delhaize shares dipped roughly 1.5% in the hours following the announcement.

Incident Details

Attribute	Value
Company	Ahold Delhaize (Zaandam, Netherlands; parent of Albert Heijn, Delhaize, Stop & Shop, Food Lion, Giant Food, The Giant Company, Hannaford, Etos, Gall & Gall)
Incident Type	Undisclosed "cybersecurity incident" / "security issue within its network"
Disclosure Date	October 12, 2026
Outage Onset	Reported starting the preceding Sunday (October 11, 2026)
Systems Taken Offline	Logistics, online ordering, customer service, loyalty programs, websites/apps, some employee HR systems (as a precaution)
Brands Confirmed Affected	Albert Heijn, Etos, Gall & Gall, Delhaize (Benelux); Stop & Shop, Food Lion, Giant Food, The Giant Company, Hannaford (U.S.)
Brands Reported Unaffected	Mega Image, Profi (Romania)
Attacker Attribution	None disclosed at time of publication
Data Exposure	Not yet confirmed either way
Market Disclosure	Flagged as "inside information" under EU Market Abuse Regulation
Prior Incident	November 2024 ransomware attack by INC Ransom, confirmed to have exposed data on 2.2 million individuals

What Happened

A sudden, broad outage across brands and borders

The outage first became visible over the weekend of October 11–12, 2026, when customers and employees across multiple Ahold Delhaize banners began reporting that websites, apps, and internal systems were unreachable. In the Netherlands and Belgium, Albert Heijn's and Delhaize's websites and mobile apps went down, online grocery orders could not be processed or delivered, loyalty-program functions stopped working, and customer service lines became unreachable. Drugstore chain Etos and liquor retailer Gall & Gall, both Ahold Delhaize subsidiaries, reported the same digital outages.

In the United States, the impact centered on internal operations rather than public-facing storefronts. Stop & Shop employees reported being unable to access work schedules or pay stubs, while Food Lion told staff internally that stores "may be unable to shop, stage, or hand off orders" — language suggesting the outage reached order-fulfillment and warehouse-management systems, not just websites. Other U.S. banners, including Giant Food, The Giant Company, and Hannaford, also reported web and app outages. In Romania, Mega Image and Profi were reported to be operating normally, suggesting the incident's reach — or at least its precautionary shutdowns — was not uniformly global.

Stores stayed open, but with visible side effects

Ahold Delhaize was explicit that in-store shopping continued and checkout systems remained functional throughout the incident. However, the outage still produced visible knock-on effects at the shelf level: with backend pricing and promotion systems offline, physical stores in the Benelux region were reportedly still displaying the previous week's prices, since updates could not be pushed through the affected systems. Online delivery and pickup orders, by contrast, were unable to proceed at all in several markets, and the company gave customers no estimate for when ordering and delivery would resume.

An unusually quiet disclosure

What Ahold Delhaize has not said is as notable as what it has. The company's statements named no threat actor, offered no detail on the initial access vector, and did not confirm or rule out ransomware, data theft, or encryption of systems. A company spokesperson did not respond to follow-up questions from reporters about the scope of the intrusion. As of publication, no ransomware group had claimed responsibility on a leak site or elsewhere. That silence is itself consistent with an active incident-response and containment effort — companies typically withhold technical detail until forensic investigators and outside counsel have a clearer picture, particularly when litigation, regulatory notification, or extortion negotiations may follow.

Impact Assessment

Impact Area	Description
E-Commerce & Delivery	Online ordering and delivery suspended across Albert Heijn, Delhaize, and other banners; no restoration timeline given
Logistics & Fulfillment	Food Lion warned staff that stores "may be unable to shop, stage, or hand off orders," pointing to warehouse/fulfillment system impact
Employee Operations	Stop & Shop staff lost access to schedules and pay stubs, disrupting internal HR functions
In-Store Pricing	Benelux stores stuck displaying prior week's prices due to disabled backend pricing systems
Customer Service	Customer support channels for affected brands went offline, leaving shoppers without a point of contact
Investor & Market Confidence	Disclosure filed as EU "inside information"; shares dipped roughly 1.5% following the announcement
Data Confidentiality	Unconfirmed — no statement yet on whether customer, employee, or financial data was accessed
Reputational Risk	Second major cybersecurity incident disclosed by Ahold Delhaize in under two years, following the 2024 INC Ransom breach

Recommendations

For Ahold Delhaize customers

Treat any unexpected emails, texts, or calls referencing this incident — especially those asking you to "verify" account details, payment information, or loyalty-program credentials — as potential phishing until Ahold Delhaize issues official guidance through its own website or app.
Monitor bank and card statements tied to accounts used for Albert Heijn, Delhaize, Stop & Shop, Food Lion, or other affected banners, even though the company has not confirmed payment-data exposure.
Expect continued disruption to online ordering, delivery, and loyalty-program access until the company confirms systems are restored; check brand-specific channels for updates rather than relying on third-party reports.

For retail security teams

Review incident-response playbooks for scenarios that combine customer-facing outages (e-commerce, apps) with back-office disruption (logistics, HR, payroll) — the pattern reported here suggests impact beyond a single customer-facing system, consistent with either a broad precautionary shutdown or lateral movement across segments.
Audit network segmentation between corporate IT, point-of-sale/payment systems, and warehouse/logistics management systems; Ahold Delhaize's ability to keep in-store checkout running while other systems went dark suggests effective segmentation worked in at least one dimension.
Revisit third-party and supply-chain exposure assessments for any organization that integrates with Ahold Delhaize's e-commerce, logistics, or loyalty platforms, since downstream partners can also be disrupted when a retailer of this size takes systems offline.

For the broader retail sector

Treat this as the second major publicized cybersecurity incident at Ahold Delhaize since November 2024, and use it to reassess whether large retail and grocery operators — which combine high-value payment data, large employee populations, and complex logistics integrations — are adequately prioritized in your own threat model.
Note that a separate, apparently unrelated cyberattack disrupted refrigeration systems at roughly 150 Intermarché stores and other French supermarket chains (E.Leclerc, Système U) around the same week, underscoring that retail and grocery operational technology is an active target independent of this specific incident.
Maintain offline, tested fallback procedures for price updates, order fulfillment, and payroll access so that a prolonged IT outage does not cascade into customer-facing and employee-facing failures simultaneously.

Key Takeaways

Ahold Delhaize confirmed on October 12, 2026 that it took systems offline after a cybersecurity incident that began the prior weekend, affecting Albert Heijn, Delhaize, Etos, Gall & Gall, Stop & Shop, Food Lion, Giant Food, The Giant Company, and Hannaford.
Online ordering, delivery, loyalty programs, customer service, and some employee systems (schedules, pay stubs) were disrupted; physical stores stayed open with functioning checkouts, though Benelux shelf prices were stuck at the prior week's levels.
No attacker has claimed responsibility, and Ahold Delhaize has not confirmed the attack method, whether data was accessed, or when services will be restored.
The company flagged its own disclosure as "inside information" under EU Market Abuse Regulation, and shares fell roughly 1.5% following the announcement.
This is the second major cybersecurity incident disclosed by Ahold Delhaize in under two years, after the INC Ransom ransomware attack confirmed in November 2024 exposed personal, financial, and health data on 2.2 million individuals.
The incident lands amid a broader wave of retail-sector attacks, including a separate cyberattack disrupting refrigeration systems at roughly 150 Intermarché stores and other French grocery chains the same week.