Ahold Delhaize Takes Systems Offline After Cyberattack, Stores Stay Open

The global retail giant Ahold Delhaize has confirmed that a cybersecurity issue on October 12, 2026 forced it to pull parts of its IT network offline. The Dutch-owned group, which operates more than 10,000 supermarkets across North America and Europe under banners including Stop & Shop, Food Lion, Hannaford, and Giant, said its stores remained open and serving customers while teams worked to assess and mitigate the incident. It was the largest retail-sector network disruption of the fall, and one that left executives scrambling to explain what had failed and why.

In a bare-bones statement posted to its corporate newsroom at 8:29 a.m. local time on Monday, the company said it was “experiencing a security issue within its network” and taking “precautionary measures,” including shutting down specific systems to protect them. By the following day, a second statement confirmed the investigation was ongoing, that external cybersecurity experts had been engaged, and that a controlled re-launch of certain affected systems had begun. No threat actors had claimed responsibility, and no stolen data had appeared on the dark web as of the latest reporting.

What happened on October 12

The incident first became visible on Monday morning when websites for all five of Ahold Delhaize's United States grocery banners — Stop & Shop, Food Lion, Hannaford, Giant, and The Key Food Stores — went down simultaneously, displaying placeholder messages in place of normal content. Grocery Dive noted the coordinated outage was unusual and pointed to a centralized IT failure rather than a localized server issue. Ahold Delhaize's own statement said its team was “taking steps to assess and mitigate the issue,” but offered no further technical detail at the time.

A day later, the company published an expanded update from its newsroom in Zaandam, Netherlands. It said the organization was “working with relevant internal teams and external cybersecurity experts,” engaging with appropriate authorities, and conducting a full investigation. Crucially, the company said it had “no evidence at this moment that customer and associate data was taken” in the incident, a carefully worded statement that stopped short of ruling out a data breach.

How retail cyberattacks typically unfold

When a major retailer shuts down its IT core overnight, the most common explanation is a ransomware attack in which threat actors have encrypted critical systems and begun exfiltrating data. TechRadar reported that while no group had claimed responsibility and no data had surfaced on the dark web, the profile of the incident — a large, geographically distributed retail network suffering a coordinated outage — matched the signature of a ransomware operation. Ahold Delhaize's deliberate choice to leave stores open while IT systems came down suggests the attackers targeted back-office and corporate systems rather than store-level point-of-sale terminals, a common pattern in retail ransomware campaigns that prioritize disruption of supply chain, inventory, and payment systems over the physical storefront.

The company's statement that it was taking “precautionary measures” and that the re-launch of systems was “controlled” indicates a methodical incident response. Controlled re-launch, in cybersecurity parlance, means bringing systems back online in stages after confirmation that malware has been removed and backdoors closed, rather than restoring full network access all at once. That is a reassuring sign for the security team, but it also means the full scope of what was compromised may not be known for several days or weeks.

Why the details matter

Ahold Delhaize is one of the few retailers whose scale spans multiple continents. A network-wide incident of this kind affects far more than just the company's bottom line; it touches millions of customer accounts, loyalty-program databases, vendor payment records, and internal HR systems for tens of thousands of associates. Even in the absence of confirmed data theft, the operational disruption to ordering, inventory management, and online grocery channels represents a direct financial hit that will likely show up in the company's next quarterly earnings filing.

The absence of a threat-actor claim as of Tuesday's reporting is notable. Ransomware groups typically issue a public statement within 24 to 72 hours of a successful attack, either as a warning to victims or as a prelude to a data-leak site. The fact that no claim has appeared within the first day suggests one of three possibilities: the attackers are deliberately delaying their public statement to maximize pressure, the incident is a sophisticated intrusion rather than a ransomware operation, or the company is still in the early triage phase and a claim may follow in the coming days.

As of the latest available reporting, Ahold Delhaize had not confirmed the nature of the attack, the scope of systems affected, or whether any data was exfiltrated. The company asked that it not be approached with questions beyond its newsroom channels. Follow-up reporting will update as new details emerge from the company's ongoing investigation or from the authorities it has engaged.

Sources: Ahold Delhaize Newsroom; TechRadar; Grocery Dive.

Corrections: Report an error at corrections@wireshaman.com.