Ahold Delhaize keeps its stores open while some systems stay offline after a cyber incident
Ahold Delhaize, operator of more than 9,400 stores, confirmed it took some systems offline after a cybersecurity incident. A spokesperson was not immediately available to answer BleepingComputer's questions on scope or encryption.
The Watch · Security desk
Over 2.2 million individuals had personal, financial and health data stolen in a November 2024 ransomware attack on Ahold Delhaize's U.S. systems. The company runs more than 9,400 local stores, serves around 60 million customers each week and had over $104 billion in 2024 net sales.
| Figure | Value | Note | Claim |
|---|---|---|---|
| Individuals whose data was stolen, over | 2.2 million | November 2024, U.S. systems | 9 |
| Local stores, more than | 9,400 stores | 8 | |
| Weekly customers, around | 60 million | 10 | |
| 2024 net sales, over | $104 billion | 11 |
What happened
- In a short release the company said its stores are open and serving customers while its teams assess and mitigate the issue.
- Customers of Albert Heijn, Etos and Gall & Gall in the Netherlands and Delhaize in Belgium could not use websites, apps or customer service platforms.
- Stop & Shop employees in the United States had trouble reaching their work schedules and pay stubs.
- A memo shared by Food Lion employees called it an IT outage and warned that stores may be unable to shop, stage or hand off orders.
- In November 2024 a ransomware attack on its U.S. systems, claimed by INC Ransom, led to the theft of data on over 2.2 million people.
Why it matters
- Who's exposed exposure Third parties that exchange orders with these banners sit closest to the failure, because the one operational fault reported in the US is order staging and handoff.
- Who has to decide decision Partners with live connections into these platforms have to choose between leaving them open and cutting them while the company's containment is still running.
- What it sets up precedent The November 2024 breach gives partners a baseline for judging how this response compares with the last one.
Next story · Security · 8h ago
Semperis survey puts threats against ransomware victims' staff at 40% of attacksConfirmed2 publishers
The company's own wording sets the frame. It called the event a "cybersecurity incident" [1] and said taking systems offline was done "to help protect them" [2]. That makes at least part of the outage a containment step, and containment ends when the company judges the systems safe to restore.
The reports reach six banners in three countries [12]. Albert Heijn, Etos and Gall & Gall are named in the Netherlands and Delhaize in Belgium [4], with Stop & Shop and Food Lion in the United States [3][5]. We think that spread points to shared services behind the brands, though the company has not described its architecture. The banner-level detail is BleepingComputer's reporting, drawn in part from a memo shared by Food Lion employees.
Scale sets the stakes. Ahold Delhaize runs more than 9,400 stores [8] and serves around 60 million customers a week [10]. On 2024 net sales of over $104 billion [11], that averages at least $285 million a day [13]. Stores are open, so the figure shows how much passes through the company's systems. It is not a loss estimate.
For partners, the evidence is narrow. The company said "Protecting our infrastructure in the best interest of our customers, associates and partners is a top priority," [6] but the specific partner-facing failure on record is order handling at Food Lion. We'd expect third parties that exchange orders with these platforms to look there first, before treating the whole group as down.
What to watch
- A claim of responsibility from INC Ransom or another group, or a company statement on data theft or encryption.
- Whether the Food Lion order staging and handoff fault appears at other US banners such as Giant Food and Hannaford.
- Restoration of the Albert Heijn, Etos, Gall & Gall and Delhaize apps and websites.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence68
- Adoption
- Not scored
- Hype gap+12
- Incentives55
- Confidence70
Perspective Coverage
11 publishers- Builder
- Builder 4%
- Operator
- Operator 74%
- Investor
- Investor 22%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Ahold Delhaize confirmed it was forced to take some systems offline after a "cybersecurity incident."
- [2]
In its press release the company said: "Our teams are taking steps to assess and mitigate the issue. This includes taking some systems offline to help protect them. At this time, our stores are open and serving customers."
- [3]
Employees at the Stop & Shop American regional supermarket chain are having trouble accessing their schedules and pay stubs.
- [4]
Customers have been unable to use websites, apps, and customer service platforms at Albert Heijn, Etos, and Gall & Gall stores in the Netherlands, and Delhaize in Belgium.
- [5]
An internal memo shared by Food Lion employees in the United States flagged the incident as an IT outage and told them their "store may be unable to shop, stage, or hand off orders."
- [6]
The company said: "Protecting our infrastructure in the best interest of our customers, associates and partners is a top priority."
- [7]
An Ahold Delhaize spokesperson was not immediately available for comment when BleepingComputer asked whether the incident affected both corporate and store systems, whether disruptions affected stores worldwide, and whether any devices were encrypted.
- [8]
Ahold Delhaize operates more than 9,400 local stores across Europe, the United States, and Indonesia.
- [9]
A November 2024 ransomware attack on Ahold Delhaize's U.S. systems, claimed by the INC Ransom group, led to the theft of personal, financial, and health information of over 2.2 million individuals.
- [10]
Ahold Delhaize serves around 60 million customers each week through physical retail locations and online.
- [11]
Ahold Delhaize reported yearly net sales of over $104 billion in 2024.
- [12]
Reported disruption names six banners in three countries: three in the Netherlands, one in Belgium, two in the United States.
- [13]
On 2024 net sales of over $104 billion, average daily net sales are at least about $285 million.
Sources
11 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comRetail giant Ahold Delhaize takes systems offline after cyberattack
1 article · October 12, 2026
- www.govinfosecurity.com
govinfosecurity.com
1 article · October 13, 2026
- newsroom.aholddelhaize.com
newsroom.aholddelhaize.com
1 article · October 13, 2026
- Albert Heijn
nieuws.ah.nl
1 article · October 13, 2026
- Geen bezorging en verkeerde prijzen in supermarkt na 'IT-incident' bij Albert Heijn
nos.nl
1 article · October 11, 2026
- Ahold Delhaize: “Geen klantgegevens gestolen” - RetailDetail NL
retaildetail.nl
1 article · October 13, 2026
- Cyberincident raakt Albert Heijn, Etos en Gall & Gall
retailtrends.nl
1 article · October 12, 2026
- securityweek.comCyberattack Prompts Ahold Delhaize to Disconnect Systems
1 article · October 13, 2026
- Stirile ProTV
stirileprotv.ro
1 article · October 13, 2026
- thecyberexpress.comNetherlands, Belgium Face Grocery Supply Disruptions After Ahold Delhaize Incident
1 article · October 13, 2026
- therecord.mediaCyber incident hits grocery stores in US, Netherlands and Belgium
1 article · October 13, 2026
Topics and entities
Topics
- Ransomware
- Cybersecurity incidents
- Retail supply chain