Ahold Delhaize is running a two-speed recovery from a cyberattack that knocked websites and apps offline across its US and European grocery brands, with Europe coming back online days ahead of its American stores. As of October 22, 2026, the company says Belgium’s e-commerce operation is fully operational and Albert Heijn’s website and app are back, with home deliveries set to resume Friday, October 23. US brands Food Lion, Giant Food, Martin’s, Hannaford, and Stop & Shop remain without a firm restoration date, even as physical stores at every affected brand have stayed open throughout the incident.
The Ahold Delhaize cyberattack first surfaced publicly on October 12, 2026, when the Dutch-Belgian retail group confirmed a security incident it attributed to “the malicious actions of others,” according to the company’s own newsroom statement. Ten days later, the uneven pace of recovery between Ahold Delhaize’s European operations and its US supermarket chains has become the story’s defining feature, raising questions about how a single corporate parent manages incident response across two continents and a dozen retail brands at once.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What Happened: Ahold Delhaize Confirms a Cybersecurity Incident
Ahold Delhaize, the Zaandam-based parent of grocery chains spanning the Netherlands, Belgium, and the United States, confirmed on October 12 that it had detected unauthorized activity on its network. The company’s response, as described in its official newsroom statement, was to take a number of IT systems offline as a precaution, including consumer-facing websites and mobile apps. That decision affected most of Ahold Delhaize’s brands across Europe and the United States, though the scale of disruption varied brand by brand.
Crucially, Ahold Delhaize has been consistent on one point since day one: physical stores across every affected brand remained open and stocked throughout the Ahold Delhaize cyberattack. Shoppers walking into a Food Lion in North Carolina or an Albert Heijn in Amsterdam could still check out at the register even while the companion app or online ordering portal sat dark. That distinction between “store open” and “systems offline” has shaped nearly every public update the company has issued since.
The Register reported on October 19 that the outage had already stretched a week for some US brands, with digital ordering and delivery slots unavailable well past the initial disclosure. BleepingComputer’s coverage of the same period noted that the company had not disclosed the attack method, the identity of the intruders, or whether a ransom had been demanded — details that, as of this writing, Ahold Delhaize still has not confirmed publicly.
Timeline: From October 12 Disclosure to the October 22 Status Update
Ten days separate Ahold Delhaize’s initial disclosure from today’s partial-recovery update, and the gap between the European and American timelines is widening rather than closing. The table below lays out the confirmed sequence of events based on the company’s own statements and contemporaneous reporting.
| Date | Event | Source |
|---|---|---|
| October 12, 2026 | Ahold Delhaize confirms a cybersecurity incident and takes some IT systems, including websites and apps, offline as a precaution | Ahold Delhaize newsroom |
| October 19, 2026 | Reports confirm the outage has disrupted services across most US and European brands for roughly a week, with no restoration date given | The Register, BleepingComputer |
| October 19–20, 2026 | Ahold Delhaize says its investigation to date has found no evidence that sensitive customer, associate, or partner data was stolen | Ahold Delhaize, Grocery Dive |
| October 22, 2026 | Belgium’s e-commerce service is fully operational; Albert Heijn’s website and app are back online; US brand e-commerce still pending, expected “in the coming days” | Ahold Delhaize status update |
| October 23, 2026 | Albert Heijn home deliveries are expected to resume | Ahold Delhaize status update |
That last gap is the one worth watching. Ahold Delhaize has not given US customers a specific date for when Food Lion, Giant Food, Martin’s, Hannaford, or Stop & Shop will have fully functioning apps and websites again — only that service is expected to return “in the coming days.” For a sector that increasingly depends on e-commerce for curbside pickup and delivery scheduling, that kind of open-ended timeline is a real cost even when physical shelves stay fully stocked.
Which US Brands Are Affected by the Ahold Delhaize Cyberattack
Ahold Delhaize’s US division named five brands as affected by the cyberattack: Food Lion, Giant Food, Martin’s, Hannaford, and Stop & Shop. Together those chains operate thousands of stores across the US East Coast and mid-Atlantic, from Maine to Florida. Hannaford’s outage has drawn particular attention because it was already running for roughly a week by the time earlier coverage on this site tracked its digital disruption alongside a separate cyberattack that hit around 700 supermarkets in France, as reported by AP News. That French incident is a distinct event from the Ahold Delhaize cyberattack, but the timing underscores just how exposed grocery retail’s digital backbone has become this fall.
For each of the five US brands, the pattern has been identical: stores open, websites and apps down or degraded, and no brand-specific restoration date issued publicly. Ahold Delhaize has not said whether some US brands are closer to full restoration than others, which has left local news outlets and customers filling the information gap with their own reporting.
Which European Brands Are Affected
On the European side, Ahold Delhaize named Albert Heijn, Etos, and Gall & Gall as affected brands. Albert Heijn, the Netherlands’ largest supermarket chain, is also the brand furthest along in recovery: its website and app are back online as of October 22, with home deliveries expected to resume the next day. Etos, the health and beauty retailer, and Gall & Gall, the liquor retail chain, were both named as impacted but the company has not detailed brand-specific restoration timelines for either beyond the general European recovery picture.
Separately, Ahold Delhaize said its e-commerce service in Belgium is now fully operational — the clearest signal yet that the European side of the business is recovering faster than its US counterpart. That asymmetry is notable given that Ahold Delhaize is, at its core, a European company with a large American subsidiary, not the other way around. One read is that the core European IT environment was easier to restore from backups or isolate during containment; another is simply that the European brands were triaged first. Ahold Delhaize has not explained the sequencing publicly.
| Brand | Region | Stores | Digital services status (Oct. 22) |
|---|---|---|---|
| Food Lion | United States | Open | Pending, no date given |
| Giant Food | United States | Open | Pending, no date given |
| Martin’s | United States | Open | Pending, no date given |
| Hannaford | United States | Open | Pending, no date given |
| Stop & Shop | United States | Open | Pending, no date given |
| Albert Heijn | Netherlands | Open | Back online; deliveries resume Oct. 23 |
| Etos | Netherlands | Open | Not individually detailed |
| Gall & Gall | Netherlands | Open | Not individually detailed |
| Belgium e-commerce | Belgium | N/A | Fully operational |
Stores Stayed Open While the Digital Front Door Went Dark
It’s worth sitting with how unusual this split outcome actually is. In a lot of retail breach scenarios, point-of-sale systems are the first target and the thing most likely to force store closures or cash-only checkout. Here, Ahold Delhaize has repeatedly emphasized the opposite: stores across all brands remained open and able to serve customers throughout the incident, while the parts of the business that went dark were the websites, mobile apps, and the online ordering and delivery infrastructure layered on top of them.
That containment pattern suggests Ahold Delhaize’s security team made a deliberate choice to isolate customer-facing digital infrastructure rather than core store operations — a strategy that protects the in-store shopping experience at the cost of online convenience. It is also the kind of decision that is much easier to defend publicly: “we kept the lights on at your local store” is a far better message than explaining a checkout outage. Whether that was by design or simply reflects where the intrusion was detected and contained is not something Ahold Delhaize has detailed.
Executives Respond: Muller and Peters on the Record
Ahold Delhaize president and CEO Frans Muller has been the company’s primary public voice on the incident. In a statement reported by The Register, Muller said: “Taking systems offline to help protect them was a precautionary measure that affected most of our brands across Europe and the United States. The investigation to date confirms this was the right decision.” That framing — defending the decision to go dark as the safer path — has been the consistent thread running through every company statement since October 12.
Muller has also addressed the human cost of the outage directly. In a separate statement, he said: “Although this incident was caused by the malicious actions of others, we apologize for the inconvenience this has caused – especially to our customers.” It’s a notably direct apology for a company that has otherwise kept its public messaging tightly controlled and technical.
On the US side, Ahold Delhaize USA CEO Claire Peters has issued her own updates to American shoppers. In one statement, Peters said: “Over the last few days, our companies have been responding to a cybersecurity incident that has created business disruption across Ahold Delhaize USA companies, impacting our team members and the customers we are honored to serve each week.” She added that protecting the company’s infrastructure “is a top priority and as a result, we took some of our systems offline – including our brands’ websites and applications,” while stressing that “each of our brands’ stores – Food Lion, The GIANT Company, Giant Food, Hannaford and Stop & Shop – have remained open and ready to serve you” throughout the disruption.
No Evidence of Stolen Customer Data, Company Says
One of the most important claims Ahold Delhaize has made so far is also the hardest for outsiders to independently verify: that its investigation has found no evidence that sensitive customer, associate, or partner data was stolen. Grocery Dive reported that assurance as part of its coverage of the ongoing recovery, and it has since been repeated in subsequent company updates.
That phrasing deserves a careful read. “No evidence of data theft found so far” is a statement about what an active forensic investigation has turned up to date, not a closing statement that nothing happened. Companies regularly update these assessments as investigations proceed — sometimes walking a “no evidence” statement back weeks later once a deeper log review or a dark-web monitoring hit surfaces something new. For now, there is no public indication that customer payment data, loyalty program credentials, or employee records tied to the Ahold Delhaize cyberattack have surfaced anywhere, and SecurityWeek’s reporting on the restoration process has not identified any extortion site listing or leaked-data claim connected to the incident.
Why Europe Is Coming Back Online Faster Than the US
The clearest storyline to emerge from today’s update is the gap between Ahold Delhaize’s European and American recovery timelines. Belgium’s e-commerce platform is fully back. Albert Heijn’s website and app are live again, with deliveries due to resume October 23. Meanwhile, five major US grocery brands serving tens of millions of shoppers across more than a dozen states are still waiting, with Ahold Delhaize offering only a vague “coming days” window.
There are a few plausible, non-mutually-exclusive explanations, though Ahold Delhaize has not confirmed any of them specifically. IT environments acquired through decades of US grocery chain mergers — Food Lion, Giant Food, Martin’s, Hannaford, and Stop & Shop all came into the Ahold Delhaize family through separate corporate histories — tend to be more fragmented and harder to restore uniformly than a more centralized European stack built around Albert Heijn’s home market systems. It’s also possible the European brands were simply triaged first, given that Ahold Delhaize is headquartered in Zaandam and its board sits closer to the European business. Either way, the asymmetry has become the single most visible fact of this recovery.
Historical Context: Grocery Retail’s Widening Attack Surface
Grocery chains have spent the past decade digitizing nearly every part of the shopping experience — loyalty apps, curbside pickup scheduling, delivery slot booking, digital coupons tied to customer accounts — and that expansion has correspondingly widened the attack surface available to intruders. The Ahold Delhaize cyberattack lands in the same month that a separate cyberattack disrupted roughly 700 supermarkets in France, according to AP News reporting, and in a year that has already seen a steady drumbeat of retail and infrastructure-adjacent security incidents.
This isn’t an isolated sector problem, either. Earlier this month, a flaw affecting thousands of supermarket refrigeration and building-control systems built on Danfoss hardware was publicly disclosed, a reminder that grocery retailers increasingly run on a layered stack of point-of-sale, inventory, refrigeration, and e-commerce systems — any one of which can become an entry point. Elsewhere in the broader breach landscape, a ConnectWise cloud backup breach froze recovery data for more than 170 managed-service-provider tenants, and federal agencies have been tracking a parallel spike in ransomware activity, with year-over-year ransomware attack volume reported up 53 percent even as law enforcement notched isolated wins. The FBI and CISA separately warned that SafePay ransomware alone had hit roughly 600 organizations this year. None of these incidents has been publicly linked to the Ahold Delhaize cyberattack, but together they sketch the environment retailers are now operating in.
Competitive Comparison: How Ahold Delhaize’s Response Stacks Up
Measured against other retail and consumer-platform breaches disclosed this October, Ahold Delhaize’s public communication has been relatively fast and relatively transparent on the broad strokes, even without naming an attacker or attack method. The company disclosed the incident within roughly the same window it took action, named every affected brand on both continents, and has issued repeated public updates from named executives rather than routing everything through anonymous spokesperson statements.
Compare that to the pattern seen with Square Enix’s Final Fantasy XIV credential-stuffing warning, which capped a month that saw four separate breach disclosures across gaming and consumer platforms, several of which were far slower to specify which accounts or systems were actually affected. Ahold Delhaize’s willingness to name Food Lion, Giant Food, Martin’s, Hannaford, Stop & Shop, Albert Heijn, Etos, and Gall & Gall specifically — rather than issuing a vague “some of our properties” statement — stands out as a relatively higher transparency bar, even though the company still has not disclosed how the attackers got in or what data, if any, they accessed beyond the “no evidence” assurance.
Market Impact: The Cost of a Week-Plus Digital Outage
Ahold Delhaize has not disclosed a financial impact figure for the cyberattack, and any specific dollar estimate at this stage would be speculation. But the shape of the cost is predictable for any large grocery operator: lost online grocery and delivery revenue during the outage window, reputational drag among digitally-engaged shoppers who rely on apps for loyalty discounts and delivery slots, incident response and forensic investigation costs, and the less visible expense of accelerated security hardening across a sprawling, multi-brand IT estate.
Online grocery has become a meaningful growth lever for chains like Ahold Delhaize’s US and European brands, and a multi-day outage in digital ordering and delivery scheduling represents real foregone revenue even if the exact figure never becomes public. The bigger market question is whether this episode changes how investors and competitors view Ahold Delhaize’s IT risk profile heading into its next earnings disclosure — a question that will likely get addressed more directly once the company’s next quarterly results and any associated commentary from Muller become available.
Predictions: What Happens Next
- US e-commerce for Food Lion, Giant Food, Martin’s, Hannaford, and Stop & Shop likely returns within days, following the pattern already set by Albert Heijn and Belgium’s e-commerce platform.
- Expect Ahold Delhaize to face regulatory scrutiny under both EU data-protection rules and US state breach-notification laws, even without confirmed data theft, simply because of mandatory incident-disclosure obligations tied to “malicious actions of others” language.
- A more detailed incident post-mortem — likely covering attack vector, containment steps, and whether a ransom was demanded — could surface in the weeks ahead as regulators and investors press for specifics beyond the current high-level statements.
- Expect heightened phishing attempts targeting Ahold Delhaize loyalty program customers during the recovery window, a common opportunistic pattern following any high-profile retailer disruption.
- Ahold Delhaize’s next earnings call will almost certainly include analyst questions about the incident’s cost and any resulting changes to its cybersecurity capital spending.
What This Means for Shoppers Right Now
For shoppers at Food Lion, Giant Food, Martin’s, Hannaford, Stop & Shop, Albert Heijn, Etos, or Gall & Gall, the practical guidance from Ahold Delhaize itself has not changed since October 12: stores remain open and fully stocked, but anyone relying on an app for delivery scheduling, curbside pickup, or digital coupons should expect continued disruption, especially in the US, until the company issues a firmer restoration timeline. Albert Heijn customers in the Netherlands should see full functionality return fastest, with deliveries resuming October 23.
Customers concerned about their personal data should note that Ahold Delhaize’s current public position is that no evidence of stolen sensitive customer, associate, or partner data has been found. That is a meaningfully reassuring statement, but it is also an evolving one, and shoppers who use any of these apps should keep a routine eye on account activity and be skeptical of unsolicited emails or texts referencing the outage, a common vector for opportunistic phishing after any publicized retailer breach.
Frequently Asked Questions
What exactly happened in the Ahold Delhaize cyberattack?
Ahold Delhaize confirmed on October 12, 2026, that it detected a cybersecurity incident caused by what the company called “the malicious actions of others.” It took a number of IT systems offline as a precaution, including brand websites and mobile apps, affecting most of its brands across Europe and the United States.
Which US stores are affected by the Ahold Delhaize cyberattack?
Ahold Delhaize named five US brands: Food Lion, Giant Food, Martin’s, Hannaford, and Stop & Shop. Physical stores at all five have remained open throughout the incident; their websites and apps have faced ongoing disruption.
Which European brands are affected?
Albert Heijn, Etos, and Gall & Gall were named as affected European brands. Albert Heijn’s website and app are back online as of October 22, with home deliveries expected to resume October 23. Ahold Delhaize’s e-commerce service in Belgium is fully operational.
Was customer data stolen in the attack?
Ahold Delhaize says its investigation to date has found no evidence that sensitive customer, associate, or partner data was stolen. The company has not disclosed further technical detail about the intrusion.
Are grocery stores still open during the outage?
Yes. Ahold Delhaize has repeatedly stated that physical stores across all affected brands, in both the US and Europe, have remained open and able to serve customers throughout the cyberattack.
When will US apps and websites be fully restored?
Ahold Delhaize has not given a specific date for US brands. The company says e-commerce services for its US brands are expected to return “in the coming days,” without further detail as of October 22, 2026.
Is this the same incident as the France supermarket cyberattack reported by AP News?
No. The France cyberattack that reportedly disrupted around 700 supermarkets is a separate incident from the Ahold Delhaize cyberattack. There is no public confirmation that the two are connected.
Who has responded publicly on behalf of Ahold Delhaize?
Ahold Delhaize president and CEO Frans Muller and Ahold Delhaize USA CEO Claire Peters have both issued public statements addressing the incident, the decision to take systems offline, and an apology for the disruption to customers.
