Ahold Delhaize Takes Systems Offline After Cyberattack, Stores Remain Open

The statement left central questions unanswered, according to TechRadar. It is not known which parts of the operation were affected, how the attack took place or whether sensitive company or customer data was exposed. There is also no information on whether customers were affected, how many might have been or the extent of any impact.

Disruptions have affected employee services and customer-facing platforms across several brands. TechRadar, citing BleepingComputer, reported that employees at the US regional supermarket chain Stop & Shop were having trouble accessing their schedules and pay stubs. Customers in the Netherlands were unable to use websites, apps and customer service platforms at Albert Heijn, Etos and Gall & Gall, while Delhaize customers in Belgium faced similar problems, according to the report. BleepingComputer also reported, citing an internal memo shared by employees in the United States, that the company flagged the attack as an IT outage and told staff their "store may be unable to shop, stage, or hand off orders."

No threat actor had claimed responsibility for the attack, and no data had surfaced on the dark web at press time, TechRadar reported. TechRadar noted that when a company shuts down its network to contain an incident, it is usually due to a ransomware attack and data exfiltration efforts, but Ahold Delhaize has not described this incident as a ransomware attack.

Ahold Delhaize is a wholesale company and multinational retailer operating more than 9,400 stores across the United States, Europe and Indonesia, according to TechRadar. It has roughly 400,000 employees and serves about 60 million customers weekly in stores and online. Its brands include Delhaize, Maxi, Mega Image, Albert, bol, Alfa Beta, Etos, Gall & Gall and Profi in Europe, and Food Lion, Stop & Shop, Giant Food and Hannaford in the United States.

The company has dealt with major cyberattacks before. In mid-November 2024, an attack disrupted grocery stores and pharmacies in the United States, leaving phone lines disabled and forcing Ahold Delhaize to shut down parts of its network. The company later confirmed it was a ransomware attack carried out by the INC Ransom threat actor. In a filing with the Maine Attorney General's Office, it said hackers stole sensitive data on more than 2.2 million people. The data may have included internal employment records for current and former employees and, depending on the person, could include full names, postal addresses, email addresses, phone numbers, dates of birth, government-issued ID numbers, bank account numbers, health information and other employment-related information.

The 2024 incident took more than a week to remedy and caused visible disruption, TechRadar reported. Employees complained on social media, the pharmacy at Stop & Shop could not refill prescriptions at one point, Food Lion had to address missing and delayed deliveries, and Instacart order return dates were repeatedly pushed back.