Ahold Delhaize, the group behind Albert Heijn, Delhaize and a string of US grocery banners, has pulled several systems offline after finding a security problem inside its network. Its stores are still trading, but online ordering, loyalty schemes, customer service and grocery logistics are down, and nobody has yet said what got in or whether any data has left.
What happened
The problems started on the afternoon of Sunday 11 October 2026. Albert Heijn, the largest Dutch supermarket chain, first described an “IT incident” on Monday morning before calling it a cybersecurity incident. Its parent company, Ahold Delhaize, issued its own statement confirming a security issue within its network and describing the shutdown of several systems as a precautionary step to protect them.
The impact is wide. In the Netherlands, the websites and apps of Albert Heijn, the Etos drugstore chain and the Gall & Gall off-licence chain have stopped working, and none of the three can take online orders. Albert Heijn says its logistics systems have also been switched off, so home grocery deliveries are suspended until further notice. The Bonus loyalty card and personalised discounts are unavailable, and electronic shelf labels in some stores are still showing the previous week’s promotions while tills charge the current price. Customer service lines are down too.
In Belgium, Delhaize says it has stopped accepting online orders for this week and customers cannot reach its service team, although its website and app still load. Across the Atlantic, Progressive Grocer reported that websites for Ahold Delhaize’s US banners, including Food Lion, Giant Food, Hannaford and Stop & Shop, were unavailable. BleepingComputer reported that Stop & Shop staff were struggling to see their rotas and payslips, and quoted an internal Food Lion memo warning that stores “may be unable to shop, stage, or hand off orders”.
Physical shops remain open and checkouts are working. Albert Heijn says protecting the data of customers, staff and partners is its “top priority”, but it has not said whether any of that data has been touched. When this article was written, no ransomware or extortion group had publicly claimed the attack, and the company had given no date for restoring services.
The technical picture
Very little is confirmed. Ahold Delhaize has not named an attacker, an entry point or the systems involved, and a spokesperson was not available to tell BleepingComputer whether any devices had been encrypted. What we can do is read the shape of the outage.
First, this does not look like a denial of service attack. Websites that load but cannot take orders, apps that are deliberately withdrawn and logistics platforms that are switched off by the company suggest an intrusion that the defenders are trying to contain. Second, the disruption appears to span brands on two continents. If so, that suggests a shared layer has been affected or is at risk: identity services, a common integration platform, central logistics or a group-wide network.
Third, tills and stores are running, which suggests point of sale is either segmented from the affected environment or deliberately kept up as the priority, while central pricing, loyalty, ordering and fulfilment systems are dark.
This is not the group’s first serious incident. A November 2024 ransomware attack, later claimed by INC Ransom, led to the theft of personal, financial and health details of more than 2.2 million people. There is no evidence yet of any link.
Why it matters for UK organisations
Ahold Delhaize does not trade in the UK, but British retailers should treat this as another warning in a long series. The 2025 attacks on M&S and Co-op showed how quickly an intrusion at a large retailer turns into empty shelves, suspended online sales and months of recovery. Grocery runs on thin margins and tight timelines, so a few days without ordering or replenishment costs real money and piles pressure on executives.
There is also a supply chain dimension. Many UK food producers and logistics firms sell into Benelux and US grocery chains through portals, EDI links and API connections. When a large buyer is compromised, those trusted connections become an obvious route for phishing and invoice fraud, and UK suppliers should be checking them now.
Where a breach of personal data poses a risk to individuals, UK GDPR requires the regulator, now the Information Commission following its takeover from the ICO on 30 September, to be told within 72 hours of becoming aware where feasible, and a business that cannot quickly say what was accessed will struggle to meet that duty.
Expert view
From the outside, Ahold Delhaize appears to have done the hard but correct thing. Shutting systems down early is expensive and embarrassing, but it is usually cheaper than letting an intruder keep moving while the business pretends nothing is wrong. In my experience, the organisations that recover fastest are the ones willing to pull the plug before they are certain, and that have rehearsed what trading looks like with central systems dark.
The detail that stands out to me is the reach of the shutdown. When we test large retail groups, we routinely find identity, remote access and integration tooling shared across brands and regions for good commercial reasons. That makes life easier for operations and for attackers alike. A single compromised help desk process or privileged account can give a foothold in every banner at once. Social engineering of IT support staff remains one of the weakest points I see in practice, and it is cheap for attackers to try.
I would not read much into the absence of a ransom claim. Many groups wait days or weeks before posting victims. Customers should expect phishing that uses this outage as a lure, whether or not data was taken.
What to do now
- Harden the help desk. Require strong identity checks before any password or MFA reset, especially for privileged accounts (Cyber Essentials user access control).
- Map shared dependencies. List identity, network and integration services shared across brands, and plan how to isolate one without stopping all.
- Review supplier and partner connections. If you trade with Ahold Delhaize banners, rotate shared credentials and treat bank detail change requests with suspicion.
- Test your offline trading plan. Exercise a week without online ordering, loyalty and central pricing.
- Protect backups and admin access. Keep immutable backups, enforce MFA on remote and admin access, and patch internet-facing systems promptly (Cyber Essentials secure configuration and security update management).
- Prepare your reporting. Know what personal data sits in each system so you can meet the 72-hour breach reporting deadline.
Bottom line
Ahold Delhaize has confirmed a security issue and taken a large slice of its digital estate offline across Europe and the US, but it has not said how the attackers got in or whether data was stolen. For UK retailers and their suppliers, the lesson is the same one M&S and Co-op taught last year: shared infrastructure spreads the damage, the help desk is a front door, and a tested plan for trading without central systems is worth far more than a policy document.
Sources
- BleepingComputer: Retail giant Ahold Delhaize takes systems offline after cyberattack
- NL Times: “Cybersecurity incident:” Hack may be behind outage at Albert Heijn
- ITdaily: Albert Heijn and Delhaize hit by cybersecurity incident
- Cyber Security News: Ahold Delhaize Takes Systems Offline Following Cybersecurity Incident
- RetailDetail EU: Major cyber incident at Ahold Delhaize
- Cybernews: Albert Heijn cyberattack disrupts online grocery services
