Scope of the disruption across Ahold Delhaize brands
Ahold Delhaize confirmed that a cyberattack disclosed last week forced the company to take some systems offline and disrupted services at stores across Europe and the United States. Customers in the Netherlands reported being unable to use websites, apps and customer service platforms at Albert Heijn, Etos and Gall & Gall; in Belgium, Delhaize customers experienced similar outages. In the United States, employees at Stop & Shop said they had trouble accessing schedules and pay stubs.
The company said stores remained open to serve customers despite the outages, and that most store websites and apps in Central and Southeastern Europe (CSE) are now online. Ahold Delhaize added that it is still working to restore other systems and services for European and U.S. brands that remain down.
Operational recovery: which services are back and which are pending
In a Monday update, Ahold Delhaize reported several concrete recovery milestones and timelines. Albert Heijn's website and app were restored, with home deliveries expected to resume from Friday, October 23. The Etos and Gall & Gall websites were also available for customers. Ahold Delhaize said e-commerce services at its U.S. brands are expected to return "in the coming days," and that e-commerce in Belgium is fully operational.
The company declined to provide technical specifics about the systems taken offline, saying it would not share details that could interfere with response efforts or compromise security measures protecting its systems.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleInteraction with authorities and the criminal-reporting step
Ahold Delhaize said it notified the Dutch National Cyber Security Centre (NCSC) within 24 hours of discovering the malicious activity and has continued to provide timely updates to the NCSC, law enforcement and other relevant regulatory authorities. The company also filed a formal police report with the Dutch police as part of its response.
When asked immediately after the incident whether both corporate and store systems were affected and whether devices had been encrypted, a company spokesperson redirected questions to the firm's public statement. The ongoing investigation, Ahold Delhaize said, has not yet found evidence that sensitive customer, associate, or partner data was stolen in this incident.
Connection to the November 2024 breach and company footprint
This is the second major cyberattack to affect Ahold Delhaize's systems in recent years. In November 2024, the company suffered an incident that resulted in the theft of personal, financial and health information for more than 2.2 million individuals; that earlier incident was claimed by the ransomware group INC Ransom, according to the company's published record.
For context about scale: Ahold Delhaize employs more than 384,000 people and operates 9,551 stores serving 77 million customers each week across the United States, Europe and Indonesia. That footprint helps explain why outages to websites, apps and internal payroll or scheduling systems can ripple across multiple countries and tens of thousands of employees.
How technologists, regulators, and customers are affected
- Technologists and security teams: The incident shows an operational posture that prioritized keeping physical stores open while isolating affected systems. Security teams will be watching the company’s restoration timeline and its refusal to publish technical details, which the company said was to avoid compromising response efforts.
- Regulators and law enforcement: The company engaged the Dutch NCSC within 24 hours and filed a formal police report, signaling that authorities will have a central role in the investigation and any follow-up regulatory assessment.
- Customers and associates: Consumers experienced interrupted online shopping and delivery services, while employees at one U.S. brand reported trouble accessing schedules and pay stubs. Ahold Delhaize currently reports no evidence of stolen sensitive data in the ongoing investigation.
Defensive implication cited: credential use and the Blue Report 2026
The source material also cites a defensive observation from the Blue Report 2026: "Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply." The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. That finding, offered alongside the operational facts of this incident, underscores the emphasis in the company’s public messaging on containment, staged recovery and working with national cyber authorities.
Ahold Delhaize’s public account frames the response as active and cautious: key customer-facing sites have been restored in several markets, authorities have been notified and a police report has been filed, and the investigation so far has not identified theft of sensitive data. The company’s earlier, November 2024 breach — and the scale of its global operations — leave unanswered but concrete questions about restoration timelines, forensic findings and how further safeguards will be applied across brands and regions.
