Ahold Delhaize said on 12 October 2026 that it is dealing with a security issue inside its network and has taken some systems offline to protect them. Stores are still open. Online services are not.
What happened
The parent company published a short statement from Zaandam. It did not name ransomware, say whether data was taken, or give a restoration time. Albert Heijn, Etos, and Gall and Gall have described a cybersecurity incident that started on Sunday afternoon, 11 October, with systems shut down as a precaution.
BleepingComputer reported that websites, apps, and customer service are disrupted in the Netherlands and Belgium, and that some US banner sites were also down. Food Lion staff were told stores might be unable to shop, stage, or hand off online orders. Stop and Shop employees reported trouble reaching schedules and pay stubs. The company has not confirmed encryption or a worldwide store outage.
Who is affected
Ahold Delhaize runs more than 9,400 stores and serves about 60 million customers a week, with brands including Albert Heijn, Delhaize, Food Lion, Stop and Shop, Giant, and Hannaford. Checkout in physical stores is still working. Online grocery delivery, apps, and some back-office tools are the systems that failed closed.
This is the group's second major security incident in recent years. A November 2024 attack exposed personal information of over 2.2 million people and was claimed by INC Ransom. That history does not prove this incident is the same kind of attack.
What to do now
Treat unexpected email or calls about Ahold Delhaize orders, invoices, or vendor portals as untrusted until the company publishes a recovery notice. Retail incidents of this size attract invoice fraud and fake IT support within hours.
- If you supply or support any Ahold banner, confirm payment and order changes out of band. Do not trust a new bank detail in email.
- Watch for lookalike domains using Albert Heijn, Delhaize, Food Lion, or Stop and Shop names.
- Do not assume store Wi-Fi or supplier portals are safe just because the shop floor is open.
Source: Ahold Delhaize newsroom statement, 12 October 2026. Read the statement.
Also on the blog
- CyberXero used Claude Code to steal 628,000 Ukrainian records
- AvisLoader: ClickFix Windows loader using Tox for command and control
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.