On Monday 12 October 2026, Ahold Delhaize announced a cybersecurity issue and took some systems offline "to help protect them." By Wednesday 14 October, the websites and apps of its five US banners were still unavailable, for at least the third day. The company has not said who is behind it, and it has not said whether ransomware is involved.
That last point matters. Taking systems offline is also the typical response to ransomware, but this post only reports what has been stated.
What happened
Confirmed in company statements, as reported by Cybersecurity Dive and Grocery Dive on 14 October:
- Monday: the company announced a cybersecurity issue, took some systems offline and gave no restoration timeline.
- Tuesday: it said the investigation was ongoing with internal teams, external experts and "the appropriate authorities." It also said it had begun a "controlled re-launch of certain systems."
- The company said it would not share details that could compromise security or response efforts.
- Its latest statement: "we have no evidence at this moment that customer and associate data was taken in this cybersecurity incident."
Reported by the press:
- Banners named include Food Lion, Giant Food, The Giant Company and Stop & Shop. Some international banners, among them Albert Heijn, Etos and Gall & Gall, have been down since at least Monday.
- Stores and pharmacies were reported to be operating normal hours, and so were fuel stations. Banner sites told customers with unfulfilled online orders to expect refunds, and delivery was still possible through Instacart, DoorDash and Uber Eats.
- Coverage notes a 2024 incident at the company that disrupted websites and potentially exposed information of more than 2 million people. That is background, not a link to this event.
Unknown
Cause, attacker, entry point, whether any data left the network, and when full service returns.
Why it matters
The stores kept trading, but the digital channel went dark for days across several brands. Online ordering is now a dependency, and it sits on shared infrastructure. One group wide decision to isolate systems took out many sites at once.
What to do now
- List the customer facing systems that share infrastructure and ask which one switch takes them all down.
- Prepare a plain customer notice and a refund process before you need them.
- Keep a second ordering or delivery route that does not run through your own platform.
- Agree who may order an isolation, and how that decision gets communicated to store and pharmacy staff.
How this could have been avoided
The cause is undisclosed, so these are general controls for a group wide isolation scenario:
- Independent environments per brand, so containment does not have to be total.
- A documented restore order for ordering, pharmacy and payment systems.
- Third party delivery routes that stay usable while your own platform is down.
- An asset and risk register that shows which systems share what, reviewed before an incident.
Click through it at your own pace, or open it full screen.
Quick check
Has Ahold Delhaize said this was ransomware?
No. Its statements, as reported, describe a cybersecurity issue and do not mention ransomware or extortion.
Has customer data been confirmed stolen?
No. The company said it has no evidence at this moment that customer and associate data was taken, and the investigation continues.
