Ahold Delhaize

Summary

Ahold Delhaize, a Dutch‑Belgian grocery giant, suffered a cyberattack on 12 Oct 2026 that took its systems offline, disrupting online services across Europe and the US while stores stayed open; the company is restoring services and says no customer, associate or partner data was stolen.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On October 12, 2026, Ahold Delhaize took some of its systems offline as a precautionary measure after a cybersecurity incident affected its network. The action disrupted websites, applications, online ordering, home delivery, pickup, and related services across much of Europe and the United States, affecting most of the company’s brands. Albert Heijn in the Netherlands, Delhaize in Belgium, and Hannaford, Stop & Shop, Food Lion, and Giant in the United States were among the affected operations. Despite the disruption, all stores across all brands remained open and continued serving customers. Ahold Delhaize said it continued working to restore systems and maintain the distribution of groceries during the phased recovery.

The same day, separate cyberattacks disrupted refrigeration systems at about 700 supermarkets in France. According to The Associated Press, hackers forced refrigeration units into continuous defrost cycles and raised temperatures as high as 50 degrees Celsius, contributing to widespread food losses and fires. Ahold Delhaize did not identify a connection between its incident and the attacks on French retailers. Hannaford also said it had no reason to believe its network disruption was related to the French incidents. Hannaford noted that some of its locations had recently experienced refrigeration problems, but said those problems were specific to the refrigeration equipment itself.

Hannaford remained affected on Monday, October 19, one week after Ahold Delhaize shut down its websites and applications. The supermarket’s website, mobile application, and Hannaford To Go pickup and delivery services were still experiencing network problems, although its physical stores remained open. Customers could continue ordering from Hannaford through Instacart, DoorDash, and Uber Eats. By that Monday, Ahold Delhaize announced that many of its European websites and applications had been restored. E-commerce services for its US brands were expected to return in the coming days, while Albert Heijn was expected to resume home deliveries by Friday.

On October 20, Ahold Delhaize said it had restored additional services affected by the previous week’s attack and expected more systems to return online within days. The company continued a phased restoration intended to support grocery distribution and customer access. Many European websites and applications were operating again, but the company had not yet provided a specific restoration date for US e-commerce services. The company maintained that stores had remained open throughout the incident.

Ahold Delhaize notified the Dutch National Cyber Security Centre and other relevant authorities shortly after discovering the attack and subsequently filed a formal police report during the following week. The company did not disclose the type of attack, the specific systems compromised, or other technical details while its investigation remained ongoing. It said withholding further information was intended to avoid compromising security measures or interfering with response efforts. Ahold Delhaize also said it had no evidence that customer, associate, or partner data had been taken.

Ahold Delhaize president and CEO Frans Muller said the company had taken systems offline to protect them and that the incident had been caused by the malicious actions of others. He apologized for the disruption, particularly to customers affected by the interruption of online ordering and delivery services. The company’s published updates continued to emphasize the restoration of digital services, the continued operation of physical stores, coordination with national and law-enforcement authorities, and the absence of evidence at that point that sensitive data had been stolen.

Sources

Sources available to members: 5 sources.