Ahold Delhaize, which runs more than 9,400 stores and reported over $104 billion in net sales in 2024, confirmed on 12 October 2026 that it had a security issue inside its network. The company took some systems offline to contain it. Stores stayed open. A lot of everything else did not.
What happened
The company said teams were assessing and mitigating the issue, including taking systems offline to protect them. It has not said whether devices were encrypted, whether data left the network, or how the intruder got in. A spokesperson pointed reporters back at that statement when asked if the hit covered both corporate and store systems, and whether it was worldwide.
Customer-facing damage is already visible. Albert Heijn, Etos, and Gall and Gall in the Netherlands, and Delhaize in Belgium, lost websites, apps, and customer service. Online grocery orders stopped. Electronic shelf labels showed stale prices while tills charged the current ones. Several Albert Heijn distribution centres stopped, which risks empty shelves. In the US, Stop and Shop staff reported they could not reach schedules and pay stubs, and Food Lion told stores they might be unable to shop, stage, or hand off orders. Hannaford and Giant Food sites were also offline. The Boston Globe was told refrigeration and point-of-sale in US stores were unaffected.
This is the group's second major incident in two years. INC Ransom stole personal, financial, and health data on more than 2.2 million people in a November 2024 attack on US systems. Nothing public ties that group to this week's outage.
Who is affected
Shoppers and staff at Ahold Delhaize brands in Europe and the United States, plus any supplier whose ordering, invoicing, or EDI link depends on systems the group has taken down. The company employs nearly 400,000 people and serves about 60 million customers a week. For an MSP, the useful lesson is the blast radius: identity, workforce apps, e-commerce, and warehouse systems went down together while the till stayed up.
- Europe: Albert Heijn, Etos, Gall and Gall, Delhaize.
- United States: Stop and Shop, Food Lion, Hannaford, Giant Food sites and apps.
- Suppliers with live EDI or API jobs into those brands.
What to do now
If you integrate with an Ahold brand, pause automated file drops and credentialed API jobs until the group confirms those paths are clean. Do not treat a retail client's stores-are-open line as proof the back office is safe. Check whether your own remote-access, payroll, and ordering portals would survive the same containment choice. This is a watch item on attribution. The company has not confirmed ransomware or data theft.
Source: BleepingComputer, Retail giant Ahold Delhaize takes systems offline after cyberattack. Company statement: Ahold Delhaize newsroom.
Also on the blog
- CVE-2026-102255: SonicWall SMA1000 CVSS 10.0 SSRF under attack
- GitLab CVE-2026-97229: CVSS 10.0 unauthenticated RCE
- Danfoss refrigeration controllers hijacked at French supermarkets
- Midnight Mimosa: budget Android phones ship with uninstallable malware
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.