Ahold Delhaize confirms cyberattack behind outages across US and European brands

Dutch-Belgian food retailer Ahold Delhaize has confirmed that a cyberattack was behind outages that forced it to take websites, apps and other systems offline across most of its brands in Europe and the United States, according to BleepingComputer, The Record and SecurityWeek. The company, which BleepingComputer says operates 9,551 stores serving about 77 million customers a week, kept stores open but saw online ordering and home deliveries disrupted.

What happened

SecurityWeek reported that Ahold Delhaize took its systems offline on October 12 in response to "a security issue" in its network, initially without giving details. On Monday, October 19, the company said the suspicious activity it had detected in its IT systems was caused by malicious actors, The Record reported. CEO Frans Muller apologized for the disruption, described the shutdown as a precaution and attributed the incident to "the malicious actions of others," according to the reports.

The company said it notified the Dutch National Cyber Security Centre within 24 hours of discovering the malicious activity, has kept regulators and law enforcement informed and filed a formal police report with Dutch police, BleepingComputer said.

Who is affected

According to BleepingComputer, customers of Albert Heijn, Etos and Gall & Gall in the Netherlands and of Delhaize in Belgium were unable to use websites, apps or customer service platforms, while Stop & Shop employees in the US reported trouble accessing schedules and pay stubs. The Record said online shopping at Food Lion and Stop & Shop was not yet functional at the time of the update.

The company says restoration is happening in phases. Most websites and apps in Central and Southeastern Europe are back online, Belgian e-commerce is fully operational and the Albert Heijn, Etos and Gall & Gall sites are available again, with Albert Heijn home deliveries expected to resume on Friday, October 23. E-commerce for Ahold Delhaize USA brands is expected to return "in the coming days," while some systems for European and US brands remain down, BleepingComputer reported.

What we know about the attack

Ahold Delhaize has not disclosed the nature of the attack or whether a ransom was involved, citing the need to protect its response and security measures, The Record said. A spokesperson did not answer BleepingComputer's questions about whether corporate and store systems were affected or whether devices were encrypted. No group has publicly claimed the attack, according to the reports.

The company said its ongoing investigation has found no evidence that sensitive customer, associate or partner data was stolen. BleepingComputer noted that a November 2024 attack on Ahold Delhaize's US systems, claimed by the INC Ransom group, resulted in the theft of personal, financial and health information of more than 2.2 million people.

What to do

The reports do not include specific guidance for customers. Given the high-profile disruption, customers should be wary of phishing emails, texts or calls that reference the outage, refunds or delivery problems, and should rely only on official brand channels for updates.