Ahold Delhaize, the international grocery retailer behind Albert Heijn, Delhaize, Food Lion and Stop & Shop, has been dealing with a cybersecurity incident since October 11, 2026. The company took several IT systems offline as a precaution, affecting websites, mobile applications and online grocery services across multiple markets.
The company has confirmed that the incident involved malicious activity. However, the attack method, the identity of the attackers and the possibility of ransomware have not been publicly confirmed.
Incident Timeline
October 11, 2026 — Incident detected
Albert Heijn, Etos and Gall & Gall in the Netherlands experienced a cybersecurity incident. The companies took selected IT systems offline to protect their infrastructure. The disruption subsequently affected other Ahold Delhaize brands.
October 12, 2026 — First public disclosure
Ahold Delhaize publicly acknowledged a security issue within its network. The company confirmed that its teams were investigating and had taken some systems offline. Physical stores remained open and continued serving customers.
October 13, 2026 — Controlled restoration begins
The company confirmed that it was working with internal teams, external cybersecurity specialists and relevant authorities. It began restoring selected systems in a controlled manner.
At this stage, Ahold Delhaize said there was no evidence that customer, employee or partner data had been stolen. The investigation was still ongoing.
October 14, 2026 — Distribution operations affected
Albert Heijn worked to restore its distribution centres after the incident disrupted operations. The company expected the centres to become operational again during the day. Meanwhile, websites and applications belonging to several US supermarket brands remained unavailable.
October 19, 2026 — Malicious activity confirmed
Ahold Delhaize issued a further update confirming that its investigation had established that the suspicious activity resulted from malicious actions by others.
The company reported the incident to Dutch police and continued working with cybersecurity specialists. Its CEO, Frans Muller, said the decision to take systems offline had been the right precaution.
By this date, Albert Heijn’s website and mobile app were available again, and Delhaize in Belgium had resumed deliveries. However, Albert Heijn’s online grocery deliveries were not expected to resume before October 22 at the earliest. The company’s US brands were also still dealing with website and e-commerce disruptions.
Sources: Ahold Delhaize official updates and Reuters, October 19, 2026.
What Was Affected?
The incident affected several brands across Ahold Delhaize’s European and US operations.
- Netherlands: Albert Heijn, Etos and Gall & Gall experienced disruptions to digital services and business operations.
- United States: Food Lion, Stop & Shop, Giant Food, The Giant Company and Hannaford experienced website or app outages.
- Belgium: Delhaize experienced operational disruption, with deliveries resuming over the weekend before the October 19 update.
Physical stores remained open, but disruptions to distribution and digital services affected the normal shopping experience. The impact and recovery status differed between brands.
What Do We Know About the Data Breach?
As of October 19, Ahold Delhaize said it had no evidence that customer, employee or partner data had been stolen.
The company has not publicly identified the threat actor or disclosed the initial access method. Ransomware has not been officially confirmed, and no connection has been established between this incident and the separate cyberattack affecting French supermarkets during the same period.
The investigation remains ongoing. Therefore, it would be premature to describe this as a confirmed data exfiltration incident.
Current Status
As of October 19, 2026, the incident remained under investigation, with systems being restored in stages. Some digital services had returned, while online grocery deliveries and US e-commerce services continued to face disruption.
The confirmed facts point to a cybersecurity incident with significant operational impact. Whether customer information was accessed or stolen remains unconfirmed.
