Ahold Delhaize takes systems offline after cybersecurity incident

Key Takeaways

• Ahold Delhaize, a major food retail group, proactively took several IT systems offline after detecting a cybersecurity incident within its network.
• The incident has disrupted various customer-facing digital services, including websites, mobile applications, and home delivery for brands like Albert Heijn, Etos, and Gall & Gall.
• U.S. brands such as Food Lion, The Giant Co., Giant Food, Hannaford, and Stop & Shop also experienced website outages.
• Physical stores across all affected brands remain open and operational, though some in-store digital services like personal discounts and electronic shelf labels are impacted.
• The company has not yet disclosed the nature of the attack, the threat actor, or whether customer data has been compromised, emphasizing the offline measures as precautionary.

Ahold Delhaize Responds to Cyber Incident with System Shutdowns

On October 12, 2026, international food retail giant Ahold Delhaize initiated a precautionary shutdown of various IT systems across its network following the detection of a cybersecurity incident. The Zaandam, Netherlands-based corporation stated that internal teams are actively assessing the situation and implementing measures to mitigate potential impact. Despite the digital disruption, all physical retail locations continue to operate and serve customers.

In an official statement, Ahold Delhaize characterized the system disconnections as essential protective actions. The company affirmed, “Protecting our infrastructure in the best interest of our customers, associates and partners is a top priority,” while also issuing an apology for any inconvenience experienced by customers and partners.

Widespread Service Disruptions Across Brands

The incident has led to significant interruptions in customer services across Ahold Delhaize’s portfolio. According to DutchNews, Albert Heijn, a prominent Dutch supermarket chain, saw its website, mobile application, and home delivery services become unavailable after critical IT systems were taken offline. Sister brands Etos and Gall & Gall also reported outages affecting their customer service and logistics infrastructures.

While Albert Heijn’s physical stores remained open and checkout systems functioned normally, some digital amenities were affected. Personal discounts and savings schemes linked to the app were temporarily suspended. Furthermore, electronic shelf labels might display previous week’s offers, potentially leading to discrepancies between displayed prices and those scanned at checkout.

The impact of the incident extended beyond European operations to Ahold Delhaize’s U.S. chains. Reports from Progressive Grocer indicated that websites for Food Lion, The Giant Co., Giant Food, Hannaford, and Stop & Shop were inaccessible. Ahold Delhaize reiterated that all stores remained operational despite these online disruptions.

Uncertainty Surrounds Attack Vector and Data Exposure

Ahold Delhaize’s initial public announcement provided limited details regarding the nature of the cyber incident. The company did not identify any attackers, elaborate on how the issue originated, or specify which systems were taken offline. Crucially, there has been no confirmation of a ransomware attack, data theft, or the initial point of compromise. These information gaps mean the precise cause and full extent of the incident remain under investigation.

The decision to take systems offline is therefore presented as a preventative measure rather than an explicit confirmation of a particular attack methodology. Ahold Delhaize explicitly stated that systems were disconnected “to help protect them,” a phrasing that describes their defensive response without confirming whether files were encrypted or customer records accessed by unauthorized parties.

Precedent for Retail Sector Disruptions

Similar proactive shutdowns have been observed in the retail sector following cybersecurity incidents. Cyber Security News previously reported on United Natural Foods taking its systems offline in June 2025 after detecting unauthorized activity, which subsequently impacted the distributor’s ability to fulfill and deliver customer orders.

The publication also covered Victoria’s Secret suspending its website services in May 2025 due to a security incident, while its physical stores continued to operate. These past incidents illustrate a pattern of retail businesses prioritizing system isolation during cyber events, but they do not suggest a common threat actor or specific attack method in the Ahold Delhaize case.

For Ahold Delhaize customers, the immediate consequence is primarily a reduction in access to online shopping and associated digital services, rather than store closures. The company’s initial communication did not provide an estimated timeline for service restoration or any findings regarding potential data exposure, leaving both the service recovery process and the security investigation ongoing.

What You Should Do

• Customers of affected brands should check in-store for current pricing and discounts, as digital systems may not be synchronized.
• Be vigilant for phishing attempts or suspicious communications that claim to be from Ahold Delhaize or its brands, especially those asking for personal information.
• Monitor official company channels for updates regarding service restoration and the outcome of the cybersecurity investigation.
• Consider using alternative payment methods if digital loyalty programs or app-based payment options are unavailable.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.