Ahold Delhaize Still Restoring U.S. Grocery Websites Ten Days After Cyberattack

Ahold Delhaize, the Dutch-American retail group that owns Food Lion, Stop & Shop, Giant Food and Hannaford in the United States, is entering its second week of disruption from a cybersecurity incident that forced the company to take websites, apps and loyalty systems offline across most of its brands in Europe and the United States. As of the company's most recent public update on the status of the incident, issued October 19, e-commerce for its U.S. banners had still not been restored, even as service returned in parts of Europe.

The company first disclosed the problem on October 12, when it said in a precautionary-measures statement that it was "experiencing a security issue" within its network and was taking some systems offline to protect them while stores stayed open. A follow-up notice the next day described a "controlled re-launch of certain systems" already underway, and by October 19 the company said its investigation had confirmed the outage was caused by "the malicious actions of others," though it has not described the nature of the intrusion or said whether ransomware was involved.

What the company has confirmed

Ahold Delhaize says it has no evidence, "at this moment," that sensitive customer, associate or partner data was taken, a position it has repeated in each of its three public statements since October 12. The company notified the Dutch National Cyber Security Centre within 24 hours of detecting the activity, as required under Dutch law, and on October 19 it filed a formal police report after prosecutors and police said no criminal investigation could proceed without one. Dutch police have said that, for now, "there is currently no criminal investigation into the incident."

The retailer is one of the largest grocery operators in the world. Its own description of the business puts weekly reach at more than 77 million customers across 17 brands, with roughly 384,000 associates working at more than 9,500 supermarkets, convenience stores and specialty shops in Europe, the United States and Indonesia. Outside analysts cited by Dutch financial press have estimated the cost of the outage to Albert Heijn alone, the group's flagship Netherlands chain, at more than €10 million, though Ahold Delhaize has not published its own figure. The company is scheduled to report third-quarter results on November 4, which analysts expect will be the first opportunity to see whether the incident shows up in its financials.

A ten-day outage with uneven recovery

The disruption has not affected all of the company's markets equally. In the Netherlands, the Albert Heijn website and app came back online around October 18, with home deliveries expected to resume October 23, and the Etos and Gall & Gall chains have also been restored. Belgium's e-commerce, serving Delhaize customers, is described by the company as fully operational again. Service across the company's Central and Southeastern Europe brands has mostly returned as well.

The slowest recovery has been in the United States, where Food Lion, Stop & Shop, Giant Food, The Giant Company and Hannaford websites and apps were still down as of the October 19 update, with the company saying only that e-commerce "is expected to come back in the coming days." Physical stores across every brand and every country have remained open throughout, the company has said, and some U.S. chains have directed customers toward third-party delivery platforms such as Instacart, DoorDash and Uber Eats as a workaround, while offering discounts on in-store purchases to offset the inconvenience, according to coverage by trade outlet Cybersecurity Dive. Digital loyalty and app-linked savings programs, which many U.S. shoppers rely on for weekly discounts, have also been unavailable in some markets.

A company with recent history on this front

This is not Ahold Delhaize's first major cybersecurity episode. In November 2024, the ransomware group INC Ransom claimed an attack on the company's U.S. operations that was later confirmed to have exposed personal, financial and health information belonging to more than 2.2 million people, disrupting pharmacy and e-commerce systems at several of the same American brands now affected. That history has fed scrutiny of the current incident, even though the company has drawn no public connection between the two.

Security researchers have also noted the timing against a wider wave of cyber incidents hitting European food retail in October, including an unrelated attack that disabled refrigeration-control systems at hundreds of supermarkets in France, reported separately by The Record, a news outlet covering cybersecurity. Dutch authorities have said they see no evidence linking the two situations, and Ahold Delhaize has not suggested its own incident is part of a broader campaign.

Reaction from the company and regulators

Frans Muller, Ahold Delhaize's president and chief executive, addressed the incident directly in the company's October 19 statement.

"Taking systems offline to help protect them was a precautionary measure that affected most of our brands across Europe and the United States. The investigation to date confirms this was the right decision. Although this incident was caused by the malicious actions of others, we apologize for the inconvenience this has caused — especially to our customers."

Muller added that the company remains "fully engaged with the appropriate authorities" and will continue supporting their investigations while working to restore services. Dutch police, in urging the company to file a formal complaint, framed the episode as part of a larger pattern, with a police spokesperson saying investigators can no longer treat cybercrime "as a collection of separate crimes, but as a criminal ecosystem." Coverage by The Boston Globe, among the first American outlets to report the outage, noted that New England shoppers at Stop & Shop and Hannaford were left without online ordering just as the outage began on October 12.

What happens next

Ahold Delhaize has said it will "provide further updates when appropriate" but has declined to share technical details of the intrusion, saying doing so could "compromise security measures or interfere with our response efforts." That leaves open basic questions that have accompanied the incident since it began: what kind of attack caused the outage, whether any data was in fact exfiltrated despite the company's current assessment, and who was responsible. No group has publicly claimed responsibility as of this writing.

For now, the practical test will be whether Food Lion, Stop & Shop, Giant Food and Hannaford can restore full online ordering before the Thanksgiving shopping season, historically one of the busiest stretches of the year for U.S. grocery e-commerce. The company's November 4 earnings call is likely to be the next moment at which investors, and the roughly 77 million customers who shop its brands each week, get a fuller public accounting of what went wrong and what it has cost.