For at least eight days, shoppers at Stop & Shop, Food Lion and Hannaford could not place online orders, use pickup or delivery, redeem digital coupons or use the app. The cause was a cyberattack on Ahold Delhaize, the Netherlands-based parent of those chains. Physical stores stayed open the whole time.

Web and app services began returning on Tuesday, October 20, after at least eight days offline, according to Grocery Dive. The company’s first detailed statement came in an update published October 21. It says there is no evidence that sensitive data was taken, but the investigation is still running. That leaves two open questions for shoppers and investors: how long the disruption lasted, and whether personal information is involved.

What Ahold Delhaize disclosed, and when

Ahold Delhaize first disclosed the problem on October 12. It said it had detected suspicious activity, attributed it to “the malicious actions of others,” and took some systems offline as a precaution. President and CEO Frans Muller defended that decision. “The investigation to date confirms this was the right decision,” he said.

The company says it notified the Dutch National Cyber Security Centre within 24 hours of discovering the activity, and it keeps that agency, law enforcement and regulators updated. The Record reported that the company confirmed those malicious actions were behind the outages. It has not described the nature of the attack or said whether a ransom was involved.

Security researcher Kevin Beaumont was blunt about the timing. “The latest incident started a week ago and they again waited a week to disclose,” he said, in remarks quoted by BankInfoSecurity. He also faulted the company for not saying ransomware.

The timeline so far:

  • October 12: Ahold Delhaize discloses suspicious activity and the precautionary shutdown of some systems.
  • Tuesday, October 20: Websites and apps for the US banners return after at least eight days offline.
  • October 21: The company publishes its first detailed update on the investigation.
  • October 22: Regional coverage reports websites and online shopping back for stores in New England, the Mid-Atlantic and the Southeast.
  • Friday, October 23: Albert Heijn home deliveries in the Netherlands are set to resume.

Which banners, services and workers were hit

Five US banners were affected: Food Lion, The Giant Co., Giant Food, Hannaford and Stop & Shop. The outage reached websites, apps, online ordering, pickup, delivery and digital coupons. Stores kept trading, so shoppers who walked in saw little change. Fox News describes Ahold Delhaize as owning some of America’s best-known regional supermarkets and says the parent operates more than 9,400 stores worldwide.

The damage was concentrated in digital channels. Online ordering and delivery partners were cut off, so customers who depend on those services lost access for about a week and a half, according to Fox News and other coverage.

Employees were affected too. Timekeeping and pay systems were reported as disrupted at Stop & Shop early in the incident.

For investors, the central question is how much US e-commerce revenue slipped during the outage. The sources reviewed do not quantify that loss for the US banners, so any figure would be guesswork. That gap matters because the outage hit the channels many shoppers now use for pickup and delivery.

When online ordering came back, and what is still unclear

Restoration was phased, and it did not happen at the same time everywhere. Europe came back first. Belgium’s e-commerce is fully operational, according to Tech Insider, and Albert Heijn home deliveries were set to resume on Friday, October 23.

In the US, Insurance Journal reported on October 22 that websites and online shopping for stores in New England, the Mid-Atlantic and Southeastern states were back after about eight days. Grocery Dive and Progressive Grocer also report that US sites and apps are back.

Not every outlet agrees. A Tech Insider page dated October 22 says the US brands still lack a firm restoration date. The more recent coverage is backed by several outlets, which makes it the stronger account. Still, the sources reviewed do not confirm that every banner is fully restored, including Martin’s, whose e-commerce status remains unclear.

On the European side, two retail experts consulted by RTL Z estimated Albert Heijn’s revenue loss at €120 million to €150 million, according to NL Times. That is an outside estimate, not a company figure, and it covers Europe rather than the US banners.

Is customer data at risk, and what the company has said

The company’s line on personal data is the one most readers care about. “[W]e have no evidence at this moment that suggests that any sensitive customer, associate or partner data was taken,” the company said in its newsroom update.

The sentence is carefully hedged. It refers to “sensitive” data, it describes what the company has found “at this moment,” and it sits inside an investigation that remains open. It does not say whether less sensitive details tied to online accounts were viewed.

Until the investigation closes, the company’s position is that no evidence has been found. That is not the same as saying the risk is zero.

How this compares with the 2024 ransomware breach

This is not the first time Ahold Delhaize has been hit. In November 2024, a ransomware group breached Ahold Delhaize USA Services LLC. INC Ransom claimed responsibility, but the company did not publicly confirm that group’s involvement. Fox News notes there is no confirmed link between the 2024 attack and the October 2026 incident.

Ransomware crews keep hitting large organizations, and the methods are well documented. USA 24 has reported how Qilin and Inc ransomware groups exploited a patched Palo Alto GlobalProtect VPN flaw. It has also covered how the FBI and CISA warned that SafePay ransomware has hit more than 600 organizations.

The wider European picture adds context. Insurance Journal’s reporting describes hackers raising the temperature of refrigerators at hundreds of French supermarkets, which the company said was unrelated. Outages of this kind are not limited to grocery. USA 24 reported that Bullhorn took its recruiting platform offline after a cyberattack, a reminder that a single intrusion can stop daily business operations.

What shoppers and employees should do now

Most of the practical steps are simple.

  • Before you plan a pickup or delivery, open your store’s app or website and confirm it loads and shows open time slots. Restoration was phased and varied by region, so check your own banner rather than assuming it is back.
  • Be wary of unexpected emails or texts about the outage, refunds, coupons or account problems. Open the official app or type the store address yourself instead of tapping links.
  • If you use an app or loyalty account and reuse that password elsewhere, change it now and turn on multifactor authentication if the app offers it. This is general guidance. The sources reviewed do not show the company asking customers to reset passwords.
  • Employees should treat unexpected prompts about timekeeping or pay systems as suspicious. Confirm any such request through internal IT or HR contacts before entering credentials.

What to watch next

Ahold Delhaize’s next update will matter more than the last one. If it names the attack method, says whether ransomware was involved and confirms the status of every US banner, much of the uncertainty will end. If it does not, the company will face the same questions Beaumont raised about timing and transparency.

Three other threads deserve attention. Whether any US regulator opens an inquiry is unknown, and no US regulatory action appeared in the sources reviewed. Albert Heijn’s Friday restart will show whether the European recovery holds, and the €120 million to €150 million estimate will stay an outside number until the company reports its own losses. For shoppers, the test is simpler: whether the app on their phone works on the day they need it.