Ahold Delhaize Online Outage Passes Five Days After Cyber Incident

Ahold Delhaize, the Dutch-Belgian owner of Albert Heijn, Stop & Shop, Food Lion, Hannaford and Giant, was still keeping its websites and online delivery offline on 16 October, five days after it disclosed a cybersecurity incident, according to a Reuters report. The company took some systems offline as a precaution. For a grocer with stores on two continents, the story is a long outage that leaves online channels dark even while the shops stay open.

What has Ahold Delhaize confirmed so far?

The company's own newsroom update, dated 13 October from Zaandam and updated 14 October, says it is experiencing a cybersecurity issue within its network. It took "precautionary measures, including taking some systems offline." It acknowledges the disruption to customers, associates and partners and says it is starting a "controlled re-launch" of certain systems.

The statement says the company is working with internal teams and external cybersecurity experts and is "engaging with the appropriate authorities." It also says it has no evidence at this moment that customer, associate or partner data was taken, while stressing that the investigation continues. Stores in Europe and the US remain open, and the impact differs by brand.

The company has not said what caused the incident. Fox Business reported that it has not named an attacker, and the TechJournal write-up says no ransomware group or data exposure has been identified. In the Netherlands, NL Times reported that outside experts told broadcasters NOS and Nieuwsuur it was very likely a cyberattack. Albert Heijn had not confirmed a hack at that point.

Which businesses and customers are affected?

In the US, Grocery Dive reported that the websites of five banners were down on Monday morning: Hannaford, Stop & Shop, Giant Food, Food Lion and The Giant Company. NBC Boston reported that stores, pharmacies and fuel stations stayed open during normal hours. Customers lost online ordering and digital coupons.

The effect in Europe looks heavier on logistics. Cybernews reported that some logistics systems went offline, which disrupted online grocery orders and contributed to empty shelves. It named Albert Heijn, Etos and Gall & Gall among the affected brands. Teiss reported that Delhaize in Belgium also had trouble with websites, apps and customer support platforms.

The Reuters report carried by Global Banking & Finance says Albert Heijn warned of empty produce shelves and did not expect online service to resume before Sunday. Today is Sunday, and I could not confirm whether service has returned. Start dates also differ between sources. Supermarket News dates the incident to Sunday 11 October, while the company's own notice points to 12 October.

Is this connected to the French fridge attack?

The timing invites the question. On the night of 11 October, The Hacker News reported, attackers took remote control of fridges and freezers at hundreds of French supermarkets. They reached them through a Danfoss controller that maintenance firms can manage remotely. Al Jazeera, citing AFP, reported that at least 300 Intermarché or Netto shops and more than 100 Coopérative U outlets were targeted, along with 80 Carrefour stores. Temperatures rose as high as 50°C, and some stores had fires.

The two incidents appear to be separate. Reuters, via ESM Magazine, reports that the Dutch National Cyber Security Centre sees no reason to believe the Dutch incident is linked to similar incidents in other countries. TheStreet reported that Ahold Delhaize told Reuters the same.

What is the pressure from governments?

The Dutch government is now involved. LancasterOnline, citing Reuters, reports that Dutch Justice Minister David van Weel urged Ahold Delhaize on Friday to file a criminal complaint. The snippet I read does not say why he asked, so I won't guess. A formal complaint would give investigators a legal basis to act, and a minister saying so in public suggests the government wants the case treated as a crime, not just an IT fault.

In France, the EU's agriculture commissioner Christophe Hansen wrote on X that "food security requires more attention at all levels." Two attacks on food retail in one week are already being discussed as a food-supply issue, not only a retail IT problem.

Why does the "no evidence of data theft" line matter?

Readers should take that wording at face value. The company said it has no evidence at this moment, and that its investigation is ongoing. It is a statement about what investigators have found so far, not a finding that nothing was taken. Forensic work on a large retail network can take weeks, and attackers who encrypt or disrupt systems sometimes also copy data. Nothing I read says whether this was ransomware.

The company's history adds context. TheStreet noted that Ahold Delhaize USA disclosed a cybersecurity issue on 8 November 2024. It said the opening moves looked nearly identical to this week's and that recovery was slow. Fox News reported that the ransomware group INC Ransom claimed the earlier incident, though Ahold Delhaize did not publicly confirm that. Fox also says there is no confirmed connection between that attack and this one.

What should other retailers take from this?

These points are our analysis, not findings from the sources above.

• Treat shutdown as a planned scenario. Ahold Delhaize chose to take systems offline, and that choice cost it online revenue for days. Decide in advance who may order a shutdown, which systems go first, and how stores keep trading without them. Here the physical stores kept working while e-commerce and some logistics did not.
• Map your digital dependencies. Grocery Dive noted that Food Lion, Giant Food and The Giant Company pointed customers to Instacart, DoorDash and Uber Eats for delivery while their own sites were down. Third-party channels can serve as a fallback, but only if they do not run on the compromised systems.
• Audit remote-access paths to operational equipment. The French case turned on a controller that maintenance firms can manage remotely. The Hacker News reports that the French agency's alert warns against exposing management interfaces to the internet, though it does not say that was the route. Ask your facilities and refrigeration vendors how they connect to your stores.
• Prepare the disclosure wording. Companies in this position often say little while they investigate. Ahold Delhaize's notices are short by design. Have a plan for what you can say, to whom, and how often.

What to watch next

Four questions will show how serious this is. First, whether the online services actually return this week, and how fully. Second, whether Ahold Delhaize names a cause or an attacker, or a group claims it. Third, whether the "no evidence" statement on data changes. Fourth, whether the Dutch minister's call produces a formal criminal complaint. Any of these could also bring in regulators, and I have not seen reporting on that yet.