Skip to content

Security Widely confirmed11 publishers 2 min read Published Updated

Ahold Delhaize keeps its stores open while some systems stay offline after a cyber incident

Ahold Delhaize, operator of more than 9,400 stores, confirmed it took some systems offline after a cybersecurity incident. A spokesperson was not immediately available to answer BleepingComputer's questions on scope or encryption.

The Watch · Security desk

Send a correction

Ahold Delhaize's 2024 attack stole health data People whose data was stolen in the November 2024 ransomware attack, beside the company's stores, weekly customers and 2024 net sales.

Over 2.2 million individuals had personal, financial and health data stolen in a November 2024 ransomware attack on Ahold Delhaize's U.S. systems. The company runs more than 9,400 local stores, serves around 60 million customers each week and had over $104 billion in 2024 net sales.

Ahold Delhaize's 2024 attack stole health data
FigureValueNoteClaim
Individuals whose data was stolen, over2.2 millionNovember 2024, U.S. systems9
Local stores, more than9,400 stores8
Weekly customers, around60 million10
2024 net sales, over$104 billion11

What happened

  • In a short release the company said its stores are open and serving customers while its teams assess and mitigate the issue.
  • Customers of Albert Heijn, Etos and Gall & Gall in the Netherlands and Delhaize in Belgium could not use websites, apps or customer service platforms.
  • Stop & Shop employees in the United States had trouble reaching their work schedules and pay stubs.
  • A memo shared by Food Lion employees called it an IT outage and warned that stores may be unable to shop, stage or hand off orders.
  • In November 2024 a ransomware attack on its U.S. systems, claimed by INC Ransom, led to the theft of data on over 2.2 million people.

Why it matters

  • Who's exposed exposure Third parties that exchange orders with these banners sit closest to the failure, because the one operational fault reported in the US is order staging and handoff.
  • Who has to decide decision Partners with live connections into these platforms have to choose between leaving them open and cutting them while the company's containment is still running.
  • What it sets up precedent The November 2024 breach gives partners a baseline for judging how this response compares with the last one.

The company's own wording sets the frame. It called the event a "cybersecurity incident" [1] and said taking systems offline was done "to help protect them" [2]. That makes at least part of the outage a containment step, and containment ends when the company judges the systems safe to restore.

The reports reach six banners in three countries [12]. Albert Heijn, Etos and Gall & Gall are named in the Netherlands and Delhaize in Belgium [4], with Stop & Shop and Food Lion in the United States [3][5]. We think that spread points to shared services behind the brands, though the company has not described its architecture. The banner-level detail is BleepingComputer's reporting, drawn in part from a memo shared by Food Lion employees.

Scale sets the stakes. Ahold Delhaize runs more than 9,400 stores [8] and serves around 60 million customers a week [10]. On 2024 net sales of over $104 billion [11], that averages at least $285 million a day [13]. Stores are open, so the figure shows how much passes through the company's systems. It is not a loss estimate.

For partners, the evidence is narrow. The company said "Protecting our infrastructure in the best interest of our customers, associates and partners is a top priority," [6] but the specific partner-facing failure on record is order handling at Food Lion. We'd expect third parties that exchange orders with these platforms to look there first, before treating the whole group as down.

What to watch

  • A claim of responsibility from INC Ransom or another group, or a company statement on data theft or encryption.
  • Whether the Food Lion order staging and handoff fault appears at other US banners such as Giant Food and Hannaford.
  • Restoration of the Albert Heijn, Etos, Gall & Gall and Delhaize apps and websites.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence68
Adoption
Not scored
Hype gap+12
Incentives55
Confidence70

Perspective Coverage

11 publishers
Builder
Builder 4%
Operator
Operator 74%
Investor
Investor 22%
Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

  1. [1]

    Ahold Delhaize confirmed it was forced to take some systems offline after a "cybersecurity incident."

    Reported Supported Source: BleepingComputer, citing the companyView cited source
  2. [2]

    In its press release the company said: "Our teams are taking steps to assess and mitigate the issue. This includes taking some systems offline to help protect them. At this time, our stores are open and serving customers."

    Reported Supported Source: Ahold Delhaize press release, as quoted by BleepingComputerView cited source
  3. [3]

    Employees at the Stop & Shop American regional supermarket chain are having trouble accessing their schedules and pay stubs.

    Reported Supported Source: BleepingComputerView cited source
  4. [4]

    Customers have been unable to use websites, apps, and customer service platforms at Albert Heijn, Etos, and Gall & Gall stores in the Netherlands, and Delhaize in Belgium.

    Reported Supported Source: BleepingComputerView cited source
  5. [5]

    An internal memo shared by Food Lion employees in the United States flagged the incident as an IT outage and told them their "store may be unable to shop, stage, or hand off orders."

    Reported Supported Source: BleepingComputer, citing an internal Food Lion memoView cited source
  6. [6]

    The company said: "Protecting our infrastructure in the best interest of our customers, associates and partners is a top priority."

    Reported Supported Source: Ahold Delhaize press release, as quoted by BleepingComputerView cited source
  7. [7]

    An Ahold Delhaize spokesperson was not immediately available for comment when BleepingComputer asked whether the incident affected both corporate and store systems, whether disruptions affected stores worldwide, and whether any devices were encrypted.

    Reported Supported Source: BleepingComputerView cited source
  8. [8]

    Ahold Delhaize operates more than 9,400 local stores across Europe, the United States, and Indonesia.

    Reported Supported Source: BleepingComputerView cited source
  9. [9]

    A November 2024 ransomware attack on Ahold Delhaize's U.S. systems, claimed by the INC Ransom group, led to the theft of personal, financial, and health information of over 2.2 million individuals.

    Reported Supported Source: BleepingComputerView cited source
  10. [10]

    Ahold Delhaize serves around 60 million customers each week through physical retail locations and online.

    Reported Supported Source: BleepingComputerView cited source
  11. [11]

    Ahold Delhaize reported yearly net sales of over $104 billion in 2024.

    Reported Supported Source: BleepingComputerView cited source
  12. [12]

    Reported disruption names six banners in three countries: three in the Netherlands, one in Belgium, two in the United States.

    Derived Supported
  13. [13]

    On 2024 net sales of over $104 billion, average daily net sales are at least about $285 million.

    Derived Supported

Sources

11 independent publishers whose own reporting we read for this story.

  1. bleepingcomputer.com

    1 article · October 12, 2026

    Retail giant Ahold Delhaize takes systems offline after cyberattack
  2. govinfosecurity.com

    1 article · October 13, 2026

    www.govinfosecurity.com
  3. newsroom.aholddelhaize.com

    1 article · October 13, 2026

    newsroom.aholddelhaize.com
  4. nieuws.ah.nl

    1 article · October 13, 2026

    Albert Heijn
  5. nos.nl

    1 article · October 11, 2026

    Geen bezorging en verkeerde prijzen in supermarkt na 'IT-incident' bij Albert Heijn
  6. retaildetail.nl

    1 article · October 13, 2026

    Ahold Delhaize: “Geen klantgegevens gestolen” - RetailDetail NL
  7. retailtrends.nl

    1 article · October 12, 2026

    Cyberincident raakt Albert Heijn, Etos en Gall & Gall
  8. securityweek.com

    1 article · October 13, 2026

    Cyberattack Prompts Ahold Delhaize to Disconnect Systems
  9. stirileprotv.ro

    1 article · October 13, 2026

    Stirile ProTV
  10. thecyberexpress.com

    1 article · October 13, 2026

    Netherlands, Belgium Face Grocery Supply Disruptions After Ahold Delhaize Incident
  11. therecord.media

    1 article · October 13, 2026

    Cyber incident hits grocery stores in US, Netherlands and Belgium

Topics and entities

Topics

  • Ransomware
  • Cybersecurity incidents
  • Retail supply chain