Ahold Delhaize pulled systems offline after a cyberattack hit stores across the US and Europe
The supermarket giant behind Stop & Shop, Albert Heijn and Delhaize says websites and apps are coming back online, with no evidence yet of stolen customer data.
Key points
- Ahold Delhaize, the parent of Stop & Shop, Albert Heijn and Delhaize, took systems offline last week after detecting malicious activity; stores stayed open throughout.
- The company says there's no evidence so far that customer, employee or partner data was stolen.
- Albert Heijn home deliveries are set to resume Friday, October 23, and Belgian e-commerce is fully back; US online shopping is still being restored.
- The Dutch National Cyber Security Centre was notified within 24 hours, and a formal police report was filed Monday.
- This is the second serious intrusion at the retailer in under a year. The November 2024 breach, claimed by INC Ransom, exposed data on more than 2.2 million people.
Ahold Delhaize, one of the world's biggest grocery chains, has confirmed that a cyberattack disclosed last week knocked websites, apps and customer-service tools offline across Europe and the United States.
Shoppers at Albert Heijn, Etos and Gall & Gall in the Netherlands couldn't use the chains' websites or apps. Workers at Stop & Shop in the US reported trouble pulling up schedules and pay stubs. Stores themselves stayed open; the disruption hit the systems around them.
What did Ahold Delhaize actually say happened?
The company says it detected malicious activity on its network and pulled some systems offline as a precaution. It hasn't described the type of attack, named a suspect, or said whether ransomware was involved. Ransomware is malicious software that scrambles a company's data until a payment is made.
In a Monday update, chief executive Frans Muller apologised to customers and said an internal investigation hasn't yet found evidence that sensitive data was taken. That phrasing is careful. It's not the same as saying nothing was taken.
Ahold Delhaize told the Dutch National Cyber Security Centre within 24 hours of spotting the activity and filed a formal police report in the Netherlands on Monday.
When will online shopping work again?
Most of it already does. The rest is being brought back brand by brand.
| Brand | Country | Status |
|---|---|---|
| Albert Heijn | Netherlands | Website and app online; home deliveries resume Oct 23 |
| Etos, Gall & Gall | Netherlands | Websites available |
| Delhaize | Belgium | E-commerce fully operational |
| Ahold Delhaize USA brands | United States | E-commerce expected back in coming days |
Should shoppers be worried about their data?
At the moment, no evidence of theft has been published. Customers don't need to change passwords on the basis of what has been disclosed so far. It's still worth watching bank and loyalty-card statements for anything odd over the next few weeks, as is good practice after any retail incident.
The caveat is history. In November 2024, attackers stole personal and financial health information on more than 2.2 million people from Ahold Delhaize's US systems. That intrusion was claimed by INC Ransom, a Russian-speaking extortion crew first seen in 2023 and tracked by several vendors under names including Gold Ionic. Our 15 October story broke the news of this second incident as it emerged.
There's no public attribution for the current incident. First reported by BleepingComputer, the attack hasn't been claimed on any known leak site at the time of writing, and the company hasn't linked it to a known group.
How active is INC Ransom right now?
Active enough to warrant watching. We've covered the group three times in October alone, including an unverified claim against an AT&T-linked domain on 16 October and a listing targeting a Richmond school for students with dyslexia on 8 October. Leak-site postings are pressure tactics, not confirmed breaches, and the group is known to recycle and exaggerate.
My read: the fact that Ahold Delhaize caught this fast enough to pull systems before checkouts went dark, and notified regulators inside a day, is the difference between the 2024 breach and this one. Whether the restraint on data-theft language holds up over the next fortnight is the thing to watch.
