Incident Response
Ahold Delhaize takes some systems offline after cyberattack
Ahold Delhaize, one of the world's largest food retailers, has taken some systems offline after a cyberattack. Stores remain open, but some services and employee systems are disrupted.
Ross Grant2 min read
The short version
Ahold Delhaize, a major supermarket group, has suffered a cyberattack. Some systems are offline, causing problems for employees and customers, but stores are still open. The company is investigating and working to fix the issue. Details about the attack are not yet public.
By the numbers
- 9,400+stores operated worldwide by Ahold DelhaizeBleepingComputer
- 60 millioncustomers served each weekBleepingComputer
- 400,000employees worldwideBleepingComputer
- $104 billionnet sales in 2024BleepingComputer
- 2.2 millionpeople affected by a previous ransomware attack in 2024BleepingComputer
What happened?
Ahold Delhaize, one of the world's largest food retailers, confirmed it took some systems offline after a cybersecurity incident. Stores remain open, but some employee and customer services are disrupted. The company is investigating and working to fix the issue.
What happened at Ahold Delhaize
Ahold Delhaize, a major global food retailer, confirmed it has taken some systems offline following a cybersecurity incident. The company operates more than 9,400 stores under brands like Delhaize, Albert Heijn, Food Lion, and Stop & Shop, serving about 60 million customers each week. In a statement, Ahold Delhaize said its stores remain open, but it apologised for any inconvenience caused to customers and partners. The company is working to assess and mitigate the issue. BleepingComputer (opens in a new tab)
Who is affected
The incident has caused problems for both employees and customers. Staff at Stop & Shop in the US have reported being unable to access their work schedules and pay stubs. In the Netherlands and Belgium, customers of Albert Heijn, Etos, Gall & Gall, and Delhaize have been unable to use websites, apps, and customer service platforms. An internal memo at Food Lion in the US described the event as an IT outage, warning that stores might not be able to shop, stage, or hand off orders. It is not yet clear how many stores or regions are affected in total.
What Ahold Delhaize has said
Ahold Delhaize has not shared technical details about the attack. When asked by BleepingComputer whether both corporate and store systems were affected, or if any devices were encrypted (which could suggest ransomware), the company referred back to its public statement. The company stressed that protecting its infrastructure is a top priority and apologised for any inconvenience.
Previous incidents
This is not the first time Ahold Delhaize has faced a cybersecurity incident. In November 2024, the ransomware group INC Ransom stole personal, financial, and health information from over 2.2 million people in an attack on the company’s US systems. That earlier breach shows that large retail organisations remain a target for cybercriminals.
What happens next
At this stage, there is no confirmation of the attack type, whether data was stolen, or if ransomware is involved. The company is still investigating. Customers and employees may continue to see disruptions until systems are restored. If personal data has been compromised, Ahold Delhaize could face regulatory scrutiny and possible fines. In the EU, for example, GDPR fines can reach up to €20 million or 4% of global annual turnover, whichever is higher.
What you should do
Customers should watch for updates from Ahold Delhaize and its brands. If you use their online services, be alert for suspicious emails or messages. Employees should follow company guidance and report any unusual activity. Security professionals in retail should review incident response plans and ensure backups and monitoring are in place.
Claimed vs confirmed
- Confirmed
Ahold Delhaize has suffered a cyberattack and taken some systems offline.
Ahold Delhaize confirmed the incident in a public statement.
- Unconfirmed
The attack involved ransomware or data theft.
Ahold Delhaize has not confirmed the attack type or whether data was stolen or encrypted.
The impact
- Money
- The company could face regulatory fines if personal data is found to be compromised. Under EU GDPR, fines can reach up to €20 million or 4% of global turnover. No financial losses have been confirmed yet.
- Reputation
- Repeated incidents may affect trust in Ahold Delhaize's ability to protect customer and employee data. The incident is visible due to service disruptions and media coverage.
- Customers
- Customers may face issues using online services and apps. There is no evidence yet of data theft, but customers should be alert for suspicious messages and monitor updates from the company.
Why it matters
Ahold Delhaize serves millions of people each week and employs nearly 400,000 staff. Disruptions can affect shopping, pay, and access to services for many people. Large retailers are frequent targets for cyberattacks, which can lead to data breaches and financial loss.
How does it work?
The company has not disclosed the attack method or whether ransomware or data theft is involved. Systems were taken offline as a precaution while the incident is investigated.
Key points
- Ahold Delhaize has taken some systems offline after a cyberattack.
- Stores remain open, but some services for staff and customers are disrupted.
- The company has not confirmed the attack type or whether data was stolen.
- Ahold Delhaize faced a major ransomware attack in 2024 affecting 2.2 million people.
- Large retailers remain high-profile targets for cybercriminals.
Sources
BleepingComputer
Reference
