Ahold Delhaize takes systems offline after cyberattack
Ahold Delhaize pulled systems offline on October 12 after a security incident, knocking out websites, apps and online grocery across Albert Heijn, Delhaize and US brands. Stores stayed open.
Dutch retail group Ahold Delhaize took part of its network offline on October 12, 2026 after detecting what it called a cybersecurity incident, disrupting online grocery, apps and brand websites across Europe and the US. Physical stores stayed open; the company has not named an attacker or confirmed any data theft.
What's affected
Ahold Delhaize runs more than 9,400 stores across Europe, the US and Indonesia. The outage hit customer-facing systems rather than checkout:
- Netherlands: Albert Heijn's website, app and home delivery went down, and its loyalty program stopped working. Etos and Gall & Gall were disrupted too.
- Belgium: Delhaize websites, apps and customer-service platforms were unavailable.
- United States: websites for Food Lion, Hannaford, Stop & Shop and both Giant Food banners were taken offline, and online ordering was suspended. Stop & Shop staff reported trouble reaching schedules and pay stubs.
Stores kept trading and checkout systems kept working. One widely reported side effect: electronic shelf labels froze on last week's promotions while current prices applied at the till. The company said it took systems offline deliberately "to help protect them" while it assesses and mitigates the issue.
Attribution status
No group has claimed responsibility, and Ahold Delhaize has not disclosed the cause or whether customer or employee data was accessed. Per BleepingComputer and Supermarket News, the company has not tied this to any actor. Treat any attribution circulating now as unconfirmed.
This is not the group's first incident. In November 2024, INC Ransom claimed an attack on Ahold Delhaize's US systems; the company later confirmed theft of personal, financial and health data affecting more than 2.2 million people. No link between the 2024 breach and this week's outage has been established.
What to watch
There is nothing for outside organizations to patch here — this is an operational incident at one retailer, not a disclosed vulnerability. The open questions that will decide how bad it is:
- Scope of the intrusion — whether corporate and store systems were both reached, which the company declined to answer.
- Data exfiltration — no theft has been confirmed; a later disclosure (as happened in 2024) would change the picture.
- Extortion — whether a ransomware group surfaces with a claim, as INC Ransom did last time.
Context
Grocery and food-logistics operators remain a high-value target: the mix of thin margins, just-in-time distribution and large loyalty datasets means an outage lands on both revenue and customers within hours. For Ahold Delhaize specifically, a second publicly disruptive security event in under two years will sharpen scrutiny of how far the 2024 lessons actually reached into its European estate.