Ahold Delhaize confirms cyberattack took US and European systems offline

CEO says proactive shutdown protected systems; no evidence of data theft so far

By LineZotpaper

Published19 October 2026

Read Time2 min

Dutch grocery giant Ahold Delhaize, operator of US supermarket chains Food Lion, Giant Food, and Stop & Shop, has confirmed that a cyberattack forced it to take IT systems, including websites and apps, offline across most of its brands in Europe and the United States. The company says it has found no evidence that sensitive customer, associate, or partner data was stolen.

Ahold Delhaize disclosed the security incident on October 12, initially describing a “security issue within its network.” On Monday, the company confirmed that “malicious actions of others” caused the problem, prompting it to proactively take certain systems offline as a precaution.

“Taking systems offline to help protect them was a precautionary measure that affected most of our brands across Europe and the United States,” said Frans Muller, president and CEO of Ahold Delhaize, in a statement. “The investigation to date confirms this was the right decision.”

The company notified the Dutch National Cyber Security Centre last week and filed a report with Dutch police on Monday. Physical stores remain open throughout the incident.

E-commerce services are gradually returning. Albert Heijn’s website and app are back online, with home deliveries expected to resume Friday. Belgian e-commerce is fully operational. Ahold Delhaize expects online services at its US brands — including Food Lion, Giant Food, Martin’s, Hannaford, and Stop & Shop — to work “in the coming days.” Etos and Gall & Gall websites are also operational, as are most websites and apps serving central and southeastern Europe.

This is Ahold Delhaize’s second major cyberattack in two years. In November 2024, the INC Ransom group claimed responsibility for a breach that ultimately compromised data belonging to more than 2.2 million people, including personal, financial, and health details.

The company has not confirmed whether the current incident is linked to a series of attacks on refrigeration controllers at hundreds of French supermarkets beginning October 11, which reportedly caused food spoilage and fires.

Analysis

Why This Matters

The disruption of IT systems at one of the world’s largest grocery groups affected millions of customers across the US and Europe, highlighting the fragility of retail infrastructure under cyberattack.
The company’s experience with a major data breach in 2024 raises concerns about whether security improvements have been sufficient.
The attack comes amid a broader wave of incidents targeting the grocery sector, including reported attacks on French supermarket refrigeration systems.

Background

Ahold Delhaize operates more than 7,000 stores across the US, Europe, and Indonesia. In November 2024, the company suffered a cyberattack that the INC Ransom group claimed responsibility for, later confirming that more than 2.2 million people’s data — including personal, financial, and health details — was stolen. The current incident began on October 12, 2026, when the company first disclosed a network security issue. Systems were taken offline proactively after the company determined that “malicious actions of others” were involved.

Key Perspectives

Company: CEO Frans Muller defended the proactive shutdown as necessary and confirmed the investigation is ongoing. Ahold Delhaize has stated that no evidence of sensitive customer, associate, or partner data theft has been found. Customers: Online ordering and delivery services have been disrupted, particularly for US and European shoppers, though physical stores remain open. Home delivery customers now face delays until services fully restore. Cybersecurity professionals: Precautionary isolation of systems is standard best practice during incident response, but questions remain about the attack vector and whether this incident is connected to the French supermarket attacks. The lack of immediate evidence of data theft does not rule out later discoveries.

What to Watch

Full restoration of e-commerce services across all US brands in the coming days and whether delivery operations normalize as expected.
The final outcome of the investigation and any potential revelation of data compromise, given the pattern from the 2024 incident.
Whether law enforcement or security researchers identify the attackers and establish any link to the refrigeration attacks in France or other retail cyberattacks.

Sources

Grocery giant Ahold Delhaize confirms cyberattack forced US and European systems offline · www.theregister.com - Articles

Checked

10 claims in this story checked against 1 source: 7 supported.

Show each claim

SupportedHeadline: Ahold Delhaize confirms a cyberattack took US and European systems offline.www.theregister.com - Articles: “Grocery giant Ahold Delhaize confirms cyberattack forced US and European systems offline.”
SupportedThe company confirmed that 'malicious actions of others' caused the problem, prompting it to take systems offline.www.theregister.com - Articles: “said that “malicious actions of others” caused the security issue”
Partly supportedOpening: a cyberattack 'forced' the company to take systems offline.www.theregister.com - Articles: “said it proactively took IT systems offline following a cyberattack”
SupportedCEO Frans Muller said taking systems offline was a precautionary measure and 'the investigation to date confirms this was the right decision.'www.theregister.com - Articles: ““Taking systems offline to help protect them was a precautionary measure that affected most of our brands across Europe and the United States,” Frans Muller, president and CEO of Ahold Delhaize, said in a Monday statement. “The investigation to date confirms this was the right decision.””
SupportedThe company has found no evidence that sensitive customer, associate, or partner data was stolen.www.theregister.com - Articles: “the investigation hasn’t uncovered any evidence to suggest the miscreants stole any “sensitive customer, associate, or partner data,””
Partly supportedPhysical stores remain open throughout the incident.www.theregister.com - Articles: “At this time, all of the physical stores remain open”
Partly supportedFires and food spoilage were caused by the attacks on refrigeration controllers at hundreds of French supermarkets, which began October 11.www.theregister.com - Articles: “The attacks reportedly pushed temperatures as high as 122°F (50°C), spoiling food and causing fires at some locations.”
SupportedAhold Delhaize notified the Dutch National Cyber Security Centre last week and filed a report with Dutch police on Monday.www.theregister.com - Articles: “The company last week notified the Dutch National Cyber Security Centre about the digital intruders, and on Monday filed a report with the Dutch police”
SupportedThe company disclosed the security incident on October 12, initially describing a 'security issue within its network.'www.theregister.com - Articles: ““Ahold Delhaize is experiencing a security issue within its network,” it said at the time”
SupportedThis is Ahold Delhaize's second major cyberattack in two years, and the November 2024 breach compromised data of more than 2.2 million people after INC Ransom claimed responsibility.www.theregister.com - Articles: “Ahold Delhaize ultimately determined more than 2.2 million people’s data - including personal, financial, and health details - had been compromised.”