Ahold Delhaize Cyberattack Disrupts Services Across US and Europe

The Ahold Delhaize cyberattack disrupted online shopping, mobile apps and other services across the United States and Europe. The retailer took some systems offline after discovering malicious activity, although its physical stores remained open.

In an October 19 update, the company outlined its recovery progress. Several European websites and apps had returned, while teams continued restoring other services on both sides of the Atlantic.

Customers and Employees Encounter Access Problems

In the Netherlands, customers experienced problems with websites, apps and customer service platforms at Albert Heijn, Etos and Gall & Gall. Meanwhile, the disruption also affected Delhaize customers in Belgium.

Employees at the US supermarket chain Stop & Shop separately reported difficulties accessing work schedules and pay statements.

Ahold Delhaize confirmed that its response included shutting down certain systems. However, it did not clarify whether attackers had encrypted devices or explain the full impact on corporate and store infrastructure.

Online Services Return as Recovery Continues

By the October 19 update, most brand websites and apps in Central and Southeastern Europe were back online. Belgium’s e-commerce services had also resumed full operation.

In the Netherlands, Albert Heijn had restored its website and app. The retailer expected home deliveries to resume on Friday, October 23.

Etos and Gall & Gall websites were also available again. However, some services across the wider group still required recovery work.

For its US brands, Ahold Delhaize expected online shopping services to return in the following days. That timetable remained an expectation rather than confirmation of completed restoration.

Investigation Has Not Found Evidence of Sensitive Data Theft

The company said its ongoing investigation had not found evidence that attackers stole sensitive customer, employee or partner information.

However, that finding remained preliminary. It did not establish a final conclusion about the attack’s impact on data.

Ahold Delhaize also withheld further technical details, citing concerns about disrupting response efforts or weakening security measures.

Consequently, the available information does not establish the attack method, identify those responsible or confirm whether ransomware played a role.

Retailer Reports Attack to Dutch Authorities

Ahold Delhaize notified the Dutch National Cyber Security Centre within 24 hours of discovering the malicious activity. It subsequently provided updates to the centre, law enforcement and relevant regulators.

The company also confirmed that it had filed a formal report with Dutch police.

Meanwhile, chief executive Frans Muller apologised for the disruption, particularly the inconvenience customers experienced.

Earlier Attack Exposed Millions of Records

The Ahold Delhaize cyberattack follows a separate incident that affected the group’s US systems in November 2024.

In that earlier case, attackers stole personal, financial and health information belonging to more than 2.2 million people. The ransomware group INC Ransom claimed responsibility.

However, the supplied information does not link that group to the latest incident.

Ahold Delhaize employs more than 384,000 people and operates 9,551 stores across the United States, Europe and Indonesia. Its businesses serve approximately 77 million customers each week.