"Taking systems offline to help protect them was a precautionary measure that affected most of our brands across Europe and the United States," Frans Muller, president and CEO of Ahold Delhaize, said in a Monday statement.
Why Ahold Delhaize pulled websites and apps offline
The multinational grocery group said it proactively took certain IT systems offline after discovering a cyber intrusion. The company originally disclosed the incident on October 12 with the statement, "Ahold Delhaize is experiencing a security issue within its network," and later described the cause as the "malicious actions of others." Ahold Delhaize said security teams "took 'some' IT systems offline" to mitigate the incident; the company has since characterized that decision as a precaution and said the investigation to date "confirms this was the right decision."
Immediate operational effects: stores stayed open, e-commerce staggered back online
Ahold Delhaize said all of its physical stores remained open while digital services were disrupted. The company reported a phased restoration: Albert Heijn’s website and app are back online and home deliveries there are expected to resume on Friday; Belgian e-commerce is "fully operational"; Etos and Gall & Gall websites are up; and the "majority of websites and apps" across brands serving central and southeastern Europe are running again. E-commerce services at the group’s American brands — Food Lion, Giant Food, Martin’s, Hannaford, and Stop & Shop — were expected to work "in the coming days."
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleNotifying Dutch cyber and law-enforcement authorities
Ahold Delhaize told The Register it notified the Dutch National Cyber Security Centre about the intruders "last week" and on Monday filed a report with the Dutch police, according to the company's statement. The company also said the investigation has not uncovered any evidence to suggest the attackers stole any "sensitive customer, associate, or partner data."
Context: a second attack in two years and the November 2024 incident
The October incident is the retailer’s second cyberattack in two years. In November 2024 a digital break‑in disrupted brands across the organization: some Stop & Shop stores struggled to fill prescriptions, and Food Lion employees reported delayed and missing deliveries. At the time, a group calling itself INC Ransom claimed responsibility and leaked documents reportedly taken from the retailer’s systems. Ahold Delhaize ultimately determined that more than 2.2 million people’s data — including "personal, financial, and health details" — had been compromised in that earlier incident.
What this means for security teams, regulators, and customers
- Security teams: The company’s choice to take systems offline was framed as a defensive step; security personnel monitoring the incident will be focused on restoration timelines and evidence preservation, given the company’s ongoing investigation and prior November 2024 compromise.
- Regulators and law enforcement: The Dutch National Cyber Security Centre and Dutch police have been notified and received a formal report, indicating the incident will proceed through national cyber-response and law-enforcement channels.
- Customers and store staff: Physical stores remained open during the disruption, but online shoppers and delivery customers have faced staggered service restorations; Albert Heijn’s home deliveries were expected to resume on Friday while American-brand e-commerce was anticipated to return "in the coming days."
Lingering question: possible link to attacks on French supermarket refrigeration
Ahold Delhaize did not immediately respond to questions from The Register about whether this incident was linked to a series of attacks on refrigeration controllers at hundreds of French supermarkets that began on October 11 and reportedly pushed temperatures as high as 122°F (50°C), spoiling food and causing fires at some locations. The company has reported no evidence so far that sensitive data was stolen, but whether the two sets of incidents share a common actor or method remains an open and concrete question.
For now, Ahold Delhaize is restoring online services across its brands, coordinating with Dutch cyber and police authorities, and continuing an internal investigation that — so far — has not found proof of stolen "sensitive customer, associate, or partner data." The company’s recent history, including the November 2024 breach that exposed data for more than 2.2 million people, makes the outcome of the current inquiry a matter of attentive interest to customers, regulators, and the wider retail-security community.
