One of the world’s biggest grocery operators kept its doors open all week and still could not deliver groceries, price items correctly, or tell staff when to show up.
A supermarket can keep its doors wide open and still fail at almost everything else. Ahold Delhaize spent this week proving it, after a cyberattack reached the network behind more than 9,400 stores. Loyalty cards died at Dutch tills. Belgian shoppers hit blank websites, and staff in the United States lost sight of their own shift times.
The group owns brands that millions of people treat as part of the weekly routine. Albert Heijn, Delhaize, Etos, Food Lion, Stop and Shop, Giant Food and Hannaford all sit under one corporate roof. Around 60 million customers pass through them every week, so a single network fault travels a very long way.
What Ahold Delhaize said about the cyberattack
The first statement arrived on October 12 and ran to only a few lines. It named a security issue inside the network and said teams were working to assess and fix it. Some systems went offline as a precaution. Stores stayed open and kept serving customers, the company added, with an apology for the trouble.
A follow-up landed the next day with a little more detail. Outside cybersecurity experts had joined the response, and the company had contacted the relevant authorities. Engineers also began a careful, controlled restart of selected systems. Nothing so far points to stolen customer, staff or partner data, though the investigation continues.
What the company will not say still matters a great deal. It has not confirmed which systems the attackers touched, how far the damage spread, or if any machines ended up encrypted. No criminal group has claimed the job either. So the source of the Ahold Delhaize cyberattack stays officially unknown.
How the Ahold Delhaize cyberattack hit shoppers across Europe
The damage looked different in every country. Shoppers at Albert Heijn, Etos and Gall and Gall in the Netherlands lost access to websites, apps and customer service lines. Some shelves then showed the wrong price. Bonus loyalty cards failed at the checkout, which turned a routine discount into an argument at the till.
Albert Heijn also pulled its logistics systems offline and paused online grocery deliveries. Empty shelves followed in parts of the country, because stock could no longer move through the chain. Delhaize in Belgium ran into the same website and app failures. By then the Ahold Delhaize cyberattack had reached well past the shop floor.
Fallout in the United States
Stop and Shop employees reported losing access to their schedules and pay stubs. Food Lion logged the event internally as an IT outage. An internal note warned stores they might not manage to pick, stage or hand over customer orders. Giant Food and Hannaford belong to the same group, so the trouble covered a wide slice of the American East Coast.
A second major hit in under two years
The Ahold Delhaize cyberattack is not the group’s first serious security failure. In November 2024, the ransomware crew INC Ransom broke into its US systems. They took personal, financial and health records belonging to more than 2.2 million people. The full scale of that theft took months to surface.
Some early coverage has pinned the current trouble on the same crew. No public evidence backs that up. The 2024 attribution appears to have carried over by mistake. Until investigators say more, the question of who ran the October 2026 Ahold Delhaize cyberattack stays wide open.
Why grocery chains make such good targets
Food retail has almost no tolerance for downtime. Fresh stock spoils, delivery slots cannot slide, and every lost hour turns into lost money. Criminals understand that pressure, so they price their demands around it.
The technology behind a group this size sprawls in every direction. One company can run tills, warehouse systems, loyalty databases, HR platforms and online stores across a dozen countries. Decades of takeovers leave those parts stitched together in awkward ways. Clean separation gets hard, so one foothold can force a shutdown far wider than the original break-in.
That explains the shape of the response here. Pulling systems offline looks drastic from the outside, yet it buys time and stops an intruder from spreading. The Ahold Delhaize cyberattack forced exactly that trade, and customers felt the result within hours.
What shoppers should do after the Ahold Delhaize cyberattack
Account hygiene is the sensible first move for anyone who shops with these brands. Change any retailer password you also use for email or banking, and turn on two-factor login where the shop offers it. Watch your inbox closely too. Criminals rush to copy trusted names during an outage, and a fake order problem message lands easily in that window.
Public Wi-Fi deserves more care than usual in the days after a retail breach. A VPN scrambles your connection on cafe and airport networks, so card details stay out of reach of anyone sharing that hotspot. It does nothing for data already sitting on a retailer’s servers. Still, it closes one of the easier routes attackers use to harvest credentials.
Bank statements are worth a closer look as well, even with no theft confirmed. Small test charges often appear before larger ones. Report anything odd straight to your bank rather than to a number pulled from an email.
Final Thoughts
Recovery now appears to be under way, and the lack of confirmed data theft counts as real good news. Yet the gap between a working supermarket and a stalled one is thinner than most shoppers imagine. Tills kept ringing while deliveries stopped and prices went wrong. Staff could not even check when they were next due in.
A company with 400,000 employees and 104 billion dollars in yearly sales will stay a target. Ahold Delhaize now faces its second cyberattack cleanup in under two years. The next incident will test how much of this response became permanent policy. Retailers that treat security as an IT line item rather than an operating risk tend to pay for that view twice.
