Ahold Delhaize Confirms 'Malicious Actions' Behind Cyber Outages Affecting Grocery Brands

Ahold Delhaize Confirms "Malicious Actions" Behind Cyber Outages

CosmicBytez Labs first reported on October 12 that Ahold Delhaize had taken systems offline across its U.S. and European grocery brands after a vaguely described "security issue within its network." A week later, the Zaandam, Netherlands-based retailer has materially escalated its own account of the incident: on October 19, 2026, the company confirmed that the outages were the result of the "malicious actions" of a third party, and said it had filed a formal police report in the Netherlands the same day. CEO Frans Müller said in a statement that "although this incident was caused by the malicious actions of others, we apologize for the inconvenience this has caused — especially to our customers."

The confirmation is the clearest signal yet that this was a deliberate cyberattack rather than an internal technical fault, even as Ahold Delhaize continues to withhold detail on the attacker's identity, the intrusion method, and whether a ransom was demanded. The company also disclosed that it notified the Dutch National Cyber Security Centre (NCSC) within 24 hours of first detecting the suspicious activity — meaning authorities were looped in almost immediately after the outage began on October 11-12, well before the public disclosure made a week ago.

Incident Update

What's New Since October 12

From "security issue" to confirmed malicious attack

The single biggest change in Ahold Delhaize's public account is linguistic but substantive: the company's October 12 statement described only a "security issue within its network," language that left open the possibility of a severe IT failure, misconfiguration, or other non-adversarial cause. The October 19 update closes that door. Ahold Delhaize now states outright that the incident was caused by "malicious actions of others," and has backed that characterization with a formal criminal complaint. That shift — from ambiguous technical language to an explicit malicious-actor attribution and a police report — is itself the news: it confirms shoppers, employees, and investors were dealing with a cyberattack from the outset, even though the company avoided saying so for a week.

Recovery is phased and uneven across brands

Restoration has not happened uniformly. In the Netherlands, Albert Heijn's, Etos's, and Gall & Gall's websites and apps are back online, though Albert Heijn's home delivery service remains suspended and is not expected to resume until Friday, October 23 — eleven days after the outage began. Belgium and most of the company's Central and Southeastern Europe operations are reported fully restored. The slowest recovery has been in the United States, where e-commerce for Food Lion and Stop & Shop remained non-functional as of the October 19 update, with the company saying only that service is expected to return "in the coming days." Physical stores across all affected banners stayed open and operational throughout the incident, consistent with what Ahold Delhaize said on October 12.

Still no attacker name, attack method, or ransom confirmation

Despite the more direct language around malicious intent, Ahold Delhaize has not named a threat actor, ransomware group, or nation-state, nor has it described how the intruders gained access or whether systems were encrypted. The company's stated reason is explicit: it is "not sharing further details that could compromise security measures or interfere with our response efforts." No ransomware group has publicly claimed the attack on a leak site, and authorities have reportedly found no confirmed link between this incident and the unrelated cyberattack that disrupted refrigeration systems at roughly 150 Intermarché stores and other French supermarket chains (E.Leclerc, Système U) during the same week.

Data impact assessment holds — for now

Ahold Delhaize reiterated that it has found "no evidence" that sensitive customer, associate, or partner data was accessed or stolen, but it paired that statement with an explicit caveat that the investigation is ongoing. That combination of language — a negative finding alongside an open investigation — mirrors how the company characterized its 2024 incident in its early days, before later confirming that data on 2.2 million individuals had in fact been exposed by the INC Ransom ransomware group. CosmicBytez Labs will continue tracking whether this incident follows the same pattern.

Impact Assessment

Recommendations

For Ahold Delhaize customers

• Treat the confirmation of "malicious actions" as reason to stay alert for phishing attempts referencing this incident, even though the company reports no evidence of data theft to date.
• If you use Albert Heijn home delivery, expect continued disruption until at least October 23, and confirm order status directly through official brand channels before assuming a delivery will arrive.
• U.S. shoppers at Food Lion or Stop & Shop should expect online ordering outages to persist for several more days and should not treat third-party reports of restoration as confirmed until the brands themselves announce it.

For retail security teams

• Note that Ahold Delhaize's own public language shifted materially between disclosures — from "security issue" to confirmed "malicious actions" — a reminder that initial breach notifications are frequently provisional and should be revisited, not treated as final, during an active incident-response engagement.
• Benchmark your own regulatory notification timelines against the 24-hour window Ahold Delhaize used to notify the Dutch NCSC; confirm your organization's playbooks meet equivalent obligations under applicable breach-notification law in each jurisdiction you operate in.
• Track the gap between "no evidence of data theft" statements and final findings in comparable incidents — Ahold Delhaize's own 2024 breach followed a similar early no-evidence statement before ultimately confirming exposure of 2.2 million records.

For the broader retail sector

• Treat uneven, multi-week recovery timelines across regions and brands as the expected norm for large multi-banner retailers recovering from a serious intrusion, not an anomaly — plan contingency communications accordingly.
• Revisit whether your organization's incident communications plan can accommodate a staged disclosure (initial vague notice, followed by a more specific confirmation days or weeks later) without appearing to contradict earlier statements or eroding customer trust.
• Continue monitoring for any eventual attacker claim or leak-site posting tied to this incident, which would provide the clearest signal yet of whether ransomware or data extortion was involved.

Key Takeaways

1. Ahold Delhaize confirmed on October 19, 2026 that the outages first disclosed on October 12 were caused by the "malicious actions" of a third party, escalating from its earlier, vaguer "security issue" language.
2. The company filed a formal police report in the Netherlands on October 19 and had notified the Dutch NCSC within 24 hours of first detecting the activity.
3. Recovery remains uneven: Dutch, Belgian, and most Central/Southeastern European brands are restored, but Food Lion and Stop & Shop e-commerce in the U.S. remains offline, and Albert Heijn home delivery isn't expected back until October 23.
4. Ahold Delhaize still has not named an attacker, disclosed the intrusion method, or confirmed/denied a ransom demand, citing the need to protect its ongoing response.
5. The company reports no evidence of stolen customer, associate, or partner data so far, but the investigation remains open — and its 2024 incident followed a similar early assessment before later confirming 2.2 million records were exposed.
6. Independent estimates cited by Dutch media put damages above €10 million, underscoring the material cost of a nearly two-week, multi-country outage at one of the world's largest grocery retailers.

Sources

• Ahold Delhaize confirms 'malicious actions' behind cyber outages affecting grocery brands — The Record
• Ahold Delhaize update on status of cybersecurity incident — Ahold Delhaize Newsroom
• Albert Heijn files police report: Confirms "suspicious" activity in cyberattack attempt — NL Times
• Retail giant Ahold Delhaize takes systems offline after cyberattack — BleepingComputer