VULNpocalypse
HighBreach / campaignOngoing

Ahold Delhaize cyberattack: websites and apps offline at Albert Heijn, Delhaize, Stop & Shop, Giant and Hannaford

Ahold Delhaize took most brands’ websites and apps offline in Europe and the US after malicious activity in its network on 12 Oct 2026. No data theft found yet.

Published
Updated
Exploitation
Yes. Ahold Delhaize confirmed malicious activity in its IT infrastructure and took systems offline from 12 October 2026

What happened

Ahold Delhaize, the Dutch-Belgian grocery group with more than 9,500 stores and about 77 million customers a week (BleepingComputer), said on 12 October 2026 that it was “experiencing a security issue within its network” and was taking “some systems offline” to protect them (Ahold Delhaize). It flagged the statement as inside information under the EU Market Abuse Regulation.

Timeline, from the company’s three statements and press reports:

  • 12 October: first statement. Stop & Shop’s website and app showed “unavailable”; its stores, pharmacies and gas stations kept operating, and unfulfilled online orders were to be refunded. Hannaford and Giant Food were also affected (WTNH). Customers of Albert Heijn, Etos, Gall & Gall and Delhaize lost websites, apps and customer service, and Stop & Shop employees reported trouble reaching schedules and pay stubs (BleepingComputer).
  • 13 October: the company began a “controlled re-launch of certain systems” with external experts, and said it had no evidence customer, associate or partner data was taken (Ahold Delhaize).
  • 19 October: the investigation confirmed the activity “resulted from the malicious actions of others”. The company had notified the Dutch National Cyber Security Centre within 24 hours of discovery and filed a police report with Dutch police that day (Ahold Delhaize).

Recovery status at the last company update (19 October) (Ahold Delhaize):

Brand or regionStatus
Albert Heijn (Netherlands)Website and app back; home deliveries expected from 23 October
Etos, Gall & Gall (Netherlands)Websites available
Delhaize (Belgium)E-commerce fully operational
Central and Southeastern EuropeMost websites and apps available
US brands (Stop & Shop, The GIANT Company, Giant Food, Hannaford)E-commerce expected “in the coming days”; on 19 October US sites and apps had been down for an eighth straight day (Supermarket News)

While their own ordering was down, the US banners pointed customers to DoorDash, Instacart and Uber Eats. Stop & Shop and The GIANT Company offered 10% off the next in-store purchase, up to $10 (Supermarket News). Food Lion is not named as affected in any source we read.

What is not known. How the attackers got in, who they are, and whether any systems were encrypted have not been disclosed. A spokesperson did not answer BleepingComputer’s question on encryption (BleepingComputer). No group has claimed the attack in the sources we read. BleepingComputer reported no evidence linking it to the refrigeration controller attacks on French supermarkets that began the night before.

Not the first time. In November 2024 an attack on Ahold Delhaize’s US systems exposed personal, financial and health data of more than 2.2 million people; INC Ransom claimed it (BleepingComputer).

The company had not published a further incident statement by 2 November (Ahold Delhaize newsroom). It reports third-quarter results on 4 November 2026; we will update this page if those results add detail.

Am I affected?

  • Customers of Albert Heijn, Etos, Gall & Gall, Delhaize, Stop & Shop, The GIANT Company, Giant Food or Hannaford: your online service was disrupted. The company says it has no evidence so far that sensitive customer data was taken; that finding can change while the investigation continues.
  • Stop & Shop online shoppers with an order that was never delivered: you are due a refund (WTNH).
  • Employees, especially at Stop & Shop: if schedules or pay stubs were unreachable in October, check that your October pay and hours were recorded correctly once access returns.
  • Customers of the US brands in 2024: that earlier breach, of more than 2.2 million people, is a separate incident with its own notices.

What to do now

  1. Ignore outage-themed offers you cannot see inside the brand’s own app or site. A real offer exists (10% off up to $10 at Stop & Shop and The GIANT Company), which makes fake “compensation” texts and emails more believable.
  2. Check your bank or card statement for refunds on Stop & Shop online orders that were cancelled during the outage.
  3. If your company runs several retail brands on shared group infrastructure: one network incident took e-commerce down across most of Ahold Delhaize’s brands on two continents at once, while stores kept trading. Test whether each brand’s storefront, and the staff scheduling and payroll portal, can be restored on its own while the shared network stays isolated, and how many days that takes.

Sources