Emerging ThreatsData Breaches

Ahold Delhaize Disrupts Operations After Cyberattack

Analyst 207||Source: BleepingComputer
Retail store interior with customers, empty checkout screen, and employee on tablet.
"Ahold Delhaize is experiencing a security issue within its network. Our teams are taking steps to assess and mitigate the issue. This includes taking some systems offline to help protect them," the company said in a succinct press release published earlier today.

Ahold Delhaize's immediate response: systems taken offline

Ahold Delhaize, a multinational retailer and wholesaler that operates more than 9,400 local stores across Europe, the United States, and Indonesia, confirmed it has taken “some systems offline” after a cybersecurity incident. The company said its teams are assessing and mitigating the issue and emphasized that “protecting our infrastructure in the best interest of our customers, associates and partners is a top priority.” The press release also stated that stores are open and serving customers.

Service disruptions at Stop & Shop, Albert Heijn, Etos, Gall & Gall, and Delhaize

Despite stores remaining open, employees and customers have reported specific disruptions across several Ahold Delhaize brands. Employees at the Stop & Shop regional chain in the United States have reported trouble accessing schedules and pay stubs. In the Netherlands, customers have been unable to use websites, apps, and customer service platforms for Albert Heijn, Etos, and Gall & Gall; in Belgium, Delhaize customers encountered similar outages on digital platforms.

Food Lion internal memo and store-level impacts

An internal memo shared by Food Lion employees in the United States described the incident as an IT outage and warned that a store “may be unable to shop, stage, or hand off orders.” That language points to operational impacts beyond back-office systems, extending to order processing and fulfillment at the store level. Ahold Delhaize did not provide further operational details in its public statement.

Spokesperson response and independent outreach

BleepingComputer reached out to Ahold Delhaize to clarify whether the incident affected both corporate and store systems, whether disruptions were global, and whether any devices were encrypted. An Ahold Delhaize spokesperson was not immediately available for comment, according to that outreach. The company’s public statement confined itself to describing the event as a “security issue within its network” and to reiterating that mitigation steps, including taking systems offline, were underway.

Connection to the November 2024 ransomware incident claimed by INC Ransom

This is the second major cybersecurity incident publicly reported to affect Ahold Delhaize in recent years. In November 2024, the company said personal, financial, and health information belonging to over 2.2 million individuals was stolen in a ransomware attack that impacted its U.S. systems and was claimed by the ransomware group INC Ransom. That prior breach, and the details Ahold Delhaize disclosed at the time, are part of the company’s recent public record and provide context for the sensitivity around its current response.

What this means for Food Lion employees, Dutch and Belgian customers, and corporate operations

  • Food Lion employees: Pay and schedule access interruptions, documented in internal communications, can directly affect workforce planning and hourly pay processing at stores flagged as impacted.
  • Dutch and Belgian customers of Albert Heijn, Etos, Gall & Gall, and Delhaize: Digital channels for shopping and customer service are unavailable in some cases, forcing customers to rely on in-store services while the company works to restore online platforms.
  • Corporate operations and risk teams: Ahold Delhaize’s decision to take systems offline is a containment step that limits immediate exposure but raises questions about the scope of the incident and the time needed to restore systems safely without exacerbating operational disruption.

Ahold Delhaize reported yearly net sales of over $104 billion in 2024, employs nearly 400,000 people, and serves around 60 million customers each week — figures that underscore the potential reach of any disruption. The company’s portfolio includes brands such as Delhaize, Maxi, Mega Image, Albert, bol, Alfa Beta, Etos, Gall & Gall, and Profi in Europe, and Food Lion, Stop & Shop, Giant Food, and Hannaford in the United States.

The company has apologized “for any inconvenience this issue may have caused customers and partners” and said mitigation is underway. Publicly available details remain limited to the company’s press release, employee memos shared internally, and reporting on the prior November 2024 incident. A clear point the record leaves open is whether any devices were encrypted or whether the disruption will produce longer-term customer-data or operational impacts — questions the company and independent investigators will need to answer as mitigation proceeds.

Source: BleepingComputer — Retail giant Ahold Delhaize takes systems offline after cyberattack

CyberattackEmerging ThreatsEuropeRansomwareRetailSupply ChainUnited StatesIndonesiaMultinational Corporations
Related Intelligence

Continue Reading

Dimly lit office space with scattered papers and a laptop displaying a blurred image.

Leaked Files Expose Luna Moth Ransomware Group's Tactics

Newly leaked files from an anonymous source reveal the inner workings of the notorious Luna Moth ransomware group, exposing a sophisticated data-extortion business that thrives on manipulating trust. According to Check Point's analysis, this group's tactics are far more complex and sinister than your average ransomware crew.

Analyst 207
MoneyGram storefront interior with blurred financial services counter and natural light.

Ransomware Gang Targets MoneyGram in Alleged Breach

Ransomware group The Gentlemen claims to have breached financial services giant MoneyGram, which boasts 60 million active customers, but the company has yet to confirm the incident. With no concrete evidence or data samples provided, the extent of the alleged breach remains unclear.

Analyst 207
Supermarket refrigeration unit with controller and stocked shelves under fluorescent lighting.

Danfoss Controllers Targeted in Cyberattack on French Supermarkets

A cyberattack has hit several French supermarkets, forcing refrigerators to undergo emergency defrost cycles and putting fresh food at risk after hackers hijacked Danfoss refrigeration controllers. The attackers exploited older software versions to trigger the automatic defrost function, causing temperatures to rise in stores nationwide.

Analyst 207
Retail store interior with shoppers, laptop on a table, and security camera on the wall.

H&M Probes Possible Data Breach by ShinyHunters Group

H&M is investigating claims of a potential data breach after online rumors surfaced, and is working to verify if a cyber attack by the ShinyHunters group has compromised its data. The retailer says it's taking the situation seriously and prioritizing the security of its systems and data.

Analyst 207