Ahold Delhaize, the Dutch-Belgian group behind Albert Heijn, Delhaize, Food Lion and Stop & Shop, has been dealing with a cybersecurity incident since the afternoon of Sunday 11 October 2026. The company switched off systems as a precaution. That took down Albert Heijn's websites, apps, customer service and logistics systems, along with those of its sister chains Etos and Gall & Gall. Stores have stayed open, and store deliveries have resumed. Online grocery deliveries in the Netherlands are still cancelled until at least Tuesday 20 October. Ahold Delhaize says it has "no evidence at this moment that customer, associate and partner data was taken". It has not said what kind of attack this was. Ransomware is not confirmed: one security researcher has claimed it, the company neither confirms nor denies it, and no group has claimed responsibility.
Technical Information
- What the company has confirmed:
- A "security issue within its network".
- Systems taken offline to protect them.
- External cybersecurity experts brought in.
- A controlled re-launch of certain systems from 13 October.
- The company says the impact "differs per brand".
- Entry vector and malware: not disclosed. No CVE has been linked to the incident. There are no published indicators of compromise and no ATT&CK mapping.
- Nature of the attack: not confirmed. Security researcher Kevin Beaumont has claimed it is ransomware, citing internal sources (reported by AD.nl). Ahold Delhaize neither confirms nor denies this. TechRadar reported that no group had claimed the attack. NOS cited sources calling it a hack.
- Authorities: Dutch police and the Public Prosecution Service said on 14 October that no criminal investigation is under way and that they have invited Ahold Delhaize to file a report. They also said the company met its duty to report the incident under the new Dutch Cybersecurity Act. Such reports go to the NCSC.
- Data: so far there is no evidence that customer, employee or partner data was taken (Ahold Delhaize). Albert Heijn says there are "no indications" that personal data is involved, and the investigation continues.
- Timeline (Israel time, IDT):
| When (IDT) | What |
|---|---|
| Sun 11 Oct, afternoon | Incident begins at Albert Heijn, Etos and Gall & Gall; systems switched off |
| Mon 12 Oct, 09:29 | Ahold Delhaize's first public statement, issued as inside information under EU market rules |
| Tue 13 Oct | Controlled restart of some systems; Food Lion website and app reported down in the US |
| Wed 14 Oct | Police statement; Delhaize supplying Belgian stores through an alternative process; all Albert Heijn distribution centres working again that evening |
| Thu 15 Oct | Regular deliveries to Albert Heijn stores fully resumed across the Netherlands |
| Fri 16 Oct, 18:15 | Albert Heijn: online deliveries cancelled until at least Tue 20 Oct; new online orders not yet possible |
| Sat 17 Oct | Delhaize online ordering working again (Brussels Times) |
Affected Product Versions
This is an incident, not a software vulnerability, so no product versions are affected. Below are the brands and services reported as affected.
| Brand / market | Reported impact | Source |
|---|---|---|
| Albert Heijn (NL) | Websites, app and customer service down; online orders cancelled until at least 20 Oct; personal discounts, Koopzegels and Air Miles unavailable; store logistics restored 14–15 Oct | Albert Heijn |
| Etos, Gall & Gall (NL) | Named by Albert Heijn as affected since 11 Oct | Albert Heijn |
| Delhaize (BE) | Normal store ordering system unavailable; alternative supply process; online orders restored 17 Oct | Delhaize via Brussels Times |
| Food Lion (US) | Website and app down; orders refunded | Food Lion via FOX Carolina |
| Stop & Shop, Hannaford, Giant (US) | Websites and apps reported down | Press reports |
The group has not published financial impact figures. Press estimates are unconfirmed.
Workaround and Mitigation
For customers, suppliers and partners of Ahold Delhaize brands. Steps that come from Albert Heijn are attributed to it; the rest is Rescana's guidance:
- Watch for phishing. Albert Heijn warns that criminals may pose as its staff. It says it informs customers through its stores, social media and its official media-statement page. Rescana recommends checking any "Albert Heijn" or "Delhaize" message asking for payment, refunds or login details against those channels.
- Keep receipts for missed personal discounts, Koopzegels or AH Premium benefits. Albert Heijn says it will make up for these.
- Suppliers and integration partners (Rescana guidance): expect manual or alternative ordering flows while systems come back. Confirm order and invoice changes through a known contact, not through details in an unexpected email.
- Follow official updates (Rescana guidance). Use the Ahold Delhaize newsroom and Albert Heijn's media-statement page.
Indicators of Compromise
None have been published. Ahold Delhaize, the NCSC and the Dutch police have released no IoCs, and no attacker or malware has been publicly identified. We will update this post if official indicators are released.
Sources
- Ahold Delhaize newsroom: update on the cybersecurity incident
- Ahold Delhaize newsroom: precautionary measures statement
- Albert Heijn media statement (Dutch)
- Brussels Times: Delhaize resumes online orders
- FOX Carolina: Food Lion website and app down
- DutchNews: police urge Ahold to file a report
What This Means for Your Third-Party Risk Program
For most organizations, Ahold Delhaize is a sales channel, a distribution partner or a customer, not a data processor. A fast but accurate review starts by separating two questions. The first is "is our data exposed?", and current company statements do not support that. The second is "are our orders, deliveries and integrations disrupted?", and that is confirmed. Ask your contacts at the affected brands:
- Which of the systems we connect to (ordering, EDI, supplier portals, loyalty or promotions integrations) are still offline, and when will they be back?
- Have any credentials, API keys or accounts we use with you been reset? Do we need to rotate anything on our side?
- Will you tell us directly if the investigation finds that partner data was accessed?
- How should we verify payment or banking-detail changes while your normal channels are down?
Forward this to your TPRM owner: Ahold Delhaize (Albert Heijn, Etos, Gall & Gall, Delhaize, Food Lion, Stop & Shop and others) has had systems offline since 11 October because of a cybersecurity incident. Data theft and ransomware are not confirmed. Please check whether we supply, sell through or integrate with any of these brands, and send our contacts there the four questions above.
If you want to map which of your suppliers, sales channels and integrations depend on Albert Heijn, Delhaize or the other Ahold Delhaize brands, and track each contact's answers to the four questions above, book a demo.
