Ahold Delhaize Hit by Second Cyberattack in Eight Months as INC Ransom Keeps Targeting Retailers
The grocery group behind Stop & Shop, Albert Heijn and Delhaize has taken systems offline after a fresh security incident, months after INC Ransom stole data on 2.2 million people in a 2024 attack.
Key points
- Ahold Delhaize, the Dutch-Belgian company that owns Stop & Shop and Albert Heijn, took some systems offline after detecting a security incident in July 2025.
- A November 2024 ransomware attack on the same company, claimed by the INC Ransom criminal group, exposed the personal information of more than 2.2 million people, confirmed in a US regulatory filing in June 2025.
- Preventive shutdowns disrupted online orders and deliveries for Albert Heijn and Delhaize customers in Belgium and the Netherlands; US stores were also affected.
- It is not yet known whether this new incident is connected to the 2024 INC Ransom attack or is a separate event.
Ahold Delhaize, the Dutch-Belgian grocery group whose brands fill supermarket shelves from Amsterdam to Atlanta, has disconnected parts of its IT network after finding what it called a "security issue" inside its systems. Shops remain open, though the company acknowledged disruption to customers and partners.
Local media reported shutdowns hit online orders and deliveries at Albert Heijn in the Netherlands and Delhaize in Belgium. US stores appear to have been caught up too. Incident-response teams are working to assess and contain the damage; that's the extent of what the company has said publicly.
Is this connected to last year's ransomware attack?
Not confirmed. Ahold Delhaize hasn't drawn any link between the two events.
The backstory is worth understanding. In November 2024, the company suffered a ransomware attack, meaning criminals broke in, encrypted files and sought payment. That attack hit Giant Food pharmacies, Hannaford supermarkets, Food Lion and Stop & Shop. INC Ransom, a criminal ransomware group, claimed credit in April 2025.
SecurityWeek also flagged a separate, unresolved question: whether the current incident is related to a cyberattack that reportedly hit refrigeration systems in hundreds of European supermarkets over the same weekend.
How active is INC Ransom right now?
Active enough to warrant watching closely. Threat Vectr has published three stories on INC Ransom since late September, including the group's claims against a US firm and two schools in early October. These are unverified claims the criminal group posted on its own dark-web site, not independently confirmed breaches, but the cadence signals a group running hard.
| Event | Date | Detail |
|---|---|---|
| Initial attack detected | November 2024 | Ransomware hit multiple US brand systems |
| INC Ransom claims credit | April 2025 | Group posts claim on leak site |
| Data theft confirmed | April 2025 | Company acknowledges stolen data |
| US regulatory notification | June 2025 | 2.2 million individuals affected |
| New incident detected | July 2025 | Systems taken offline, investigation ongoing |
Should you worry if you shop at one of these brands?
If you haven't already received a notification about the 2024 breach, watch your post and inbox. Be sceptical of any unsolicited messages claiming to be from Stop & Shop or any related brand and asking you to verify personal details. Follow-on phishing, where criminals use stolen data to craft fake messages that extract more information, is routine after large retail breaches.
Two serious incidents in under a year at a company this size isn't a fluke. It's a pattern, and it's one that other large grocery groups should read as a warning about their own exposure.
