# Ahold Delhaize Cyberattack Knocks Out Online Ordering at Five US Chains

- URL: https://usa-24.com/ahold-delhaize-cyberattack-us-grocery-outage/
- Publisher: USA 24
- Section: Cybersecurity
- Published: 2026-10-22T16:49:47.035Z
- Updated: 2026-10-22T16:49:47.045Z
- Topics: Cybersecurity, Data Breach, Ransomware, Grocery Retail, Ahold Delhaize, Online Shopping

> Ahold Delhaize's cyberattack kept online ordering, apps and digital coupons offline at five US grocery banners for about eight days, while stores stayed open and the company says no sensitive data has been confirmed taken.

## Key takeaways

- Ahold Delhaize disclosed the cyberattack on October 12 and took some systems offline as a precaution.
- Websites and apps for five US banners, including Stop & Shop, Food Lion and Hannaford, were offline for at least eight days before returning on October 20.
- The company says it has found no evidence that sensitive customer, associate or partner data was taken, but the investigation is ongoing.
- Ahold Delhaize has not described the attack method or said whether ransomware was involved.
- Restoration was phased by region, so shoppers should confirm their local store's app or website works before relying on pickup or delivery.

For at least eight days, shoppers at Stop & Shop, Food Lion and Hannaford could not place online orders, use pickup or delivery, redeem digital coupons or use the app. The cause was a cyberattack on Ahold Delhaize, the Netherlands-based parent of those chains. Physical stores stayed open the whole time.

Web and app services began returning on Tuesday, October 20, after at least eight days offline, according to [Grocery Dive](https://www.grocerydive.com/news/ahold-delhaize-adusa-cybersecurity-update/833414/). The company’s first detailed statement came in an [update published October 21](https://storebrands.com/ahold-delhaize-provides-update-cybersecurity-incident). It says there is no evidence that sensitive data was taken, but the investigation is still running. That leaves two open questions for shoppers and investors: how long the disruption lasted, and whether personal information is involved.

## What Ahold Delhaize disclosed, and when

Ahold Delhaize first disclosed the problem on October 12. It said it had detected suspicious activity, attributed it to “the malicious actions of others,” and took some systems offline as a precaution. President and CEO Frans Muller defended that decision. “The investigation to date confirms this was the right decision,” he said.

The company says it notified the Dutch National Cyber Security Centre within 24 hours of discovering the activity, and it keeps that agency, law enforcement and regulators updated. [The Record](https://therecord.media/ahold-delhaize-cyberattack-grocery) reported that the company confirmed those malicious actions were behind the outages. It has not described the nature of the attack or said whether a ransom was involved.

Security researcher Kevin Beaumont was blunt about the timing. “The latest incident started a week ago and they again waited a week to disclose,” he said, in remarks quoted by [BankInfoSecurity](https://www.bankinfosecurity.com/supermarket-chain-ahold-delhaize-caught-in-cyber-incident-a-33072). He also faulted the company for not saying ransomware.

The timeline so far:

- October 12: Ahold Delhaize discloses suspicious activity and the precautionary shutdown of some systems.
- Tuesday, October 20: Websites and apps for the US banners return after at least eight days offline.
- October 21: The company publishes its first detailed update on the investigation.
- October 22: Regional coverage reports websites and online shopping back for stores in New England, the Mid-Atlantic and the Southeast.
- Friday, October 23: Albert Heijn home deliveries in the Netherlands are set to resume.

## Which banners, services and workers were hit

Five US banners were affected: Food Lion, The Giant Co., Giant Food, Hannaford and Stop & Shop. The outage reached websites, apps, online ordering, pickup, delivery and digital coupons. Stores kept trading, so shoppers who walked in saw little change. [Fox News](https://www.foxnews.com/tech/major-us-grocery-chains-hit-cybersecurity-incident) describes Ahold Delhaize as owning some of America’s best-known regional supermarkets and says the parent operates more than 9,400 stores worldwide.

The damage was concentrated in digital channels. Online ordering and delivery partners were cut off, so customers who depend on those services lost access for about a week and a half, according to Fox News and other coverage.

Employees were affected too. Timekeeping and pay systems were reported as disrupted at Stop & Shop early in the incident.

For investors, the central question is how much US e-commerce revenue slipped during the outage. The sources reviewed do not quantify that loss for the US banners, so any figure would be guesswork. That gap matters because the outage hit the channels many shoppers now use for pickup and delivery.

## When online ordering came back, and what is still unclear

Restoration was phased, and it did not happen at the same time everywhere. Europe came back first. Belgium’s e-commerce is fully operational, according to [Tech Insider](https://tech-insider.org/ahold-delhaize-hack-8-brands-eu-recovery-2026/), and Albert Heijn home deliveries were set to resume on Friday, October 23.

In the US, [Insurance Journal](https://www.insurancejournal.com/news/east/2026/10/22/890010.htm) reported on October 22 that websites and online shopping for stores in New England, the Mid-Atlantic and Southeastern states were back after about eight days. Grocery Dive and Progressive Grocer also report that US sites and apps are back.

Not every outlet agrees. A Tech Insider page dated October 22 says the US brands still lack a firm restoration date. The more recent coverage is backed by several outlets, which makes it the stronger account. Still, the sources reviewed do not confirm that every banner is fully restored, including Martin’s, whose e-commerce status remains unclear.

On the European side, two retail experts consulted by RTL Z estimated Albert Heijn’s revenue loss at €120 million to €150 million, according to [NL Times](https://nltimes.nl/2026/10/20/cyberattack-attempt-cost-albert-heijn-eu150-million-experts-say). That is an outside estimate, not a company figure, and it covers Europe rather than the US banners.

## Is customer data at risk, and what the company has said

The company’s line on personal data is the one most readers care about. “[W]e have no evidence at this moment that suggests that any sensitive customer, associate or partner data was taken,” the company said in its newsroom update.

The sentence is carefully hedged. It refers to “sensitive” data, it describes what the company has found “at this moment,” and it sits inside an investigation that remains open. It does not say whether less sensitive details tied to online accounts were viewed.

Until the investigation closes, the company’s position is that no evidence has been found. That is not the same as saying the risk is zero.

## How this compares with the 2024 ransomware breach

This is not the first time Ahold Delhaize has been hit. In November 2024, a ransomware group breached Ahold Delhaize USA Services LLC. INC Ransom claimed responsibility, but the company did not publicly confirm that group’s involvement. Fox News notes there is no confirmed link between the 2024 attack and the October 2026 incident.

Ransomware crews keep hitting large organizations, and the methods are well documented. USA 24 has reported how [Qilin and Inc ransomware](https://usa-24.com/cve-2026-0257-palo-alto-vpn-ransomware/) groups exploited a patched Palo Alto GlobalProtect VPN flaw. It has also covered how the FBI and CISA warned that [SafePay ransomware has hit more than 600 organizations](https://usa-24.com/safepay-ransomware-600-victims/).

The wider European picture adds context. Insurance Journal’s reporting describes hackers raising the temperature of refrigerators at hundreds of French supermarkets, which the company said was unrelated. Outages of this kind are not limited to grocery. USA 24 reported that [Bullhorn took its recruiting platform offline after a cyberattack](https://usa-24.com/bullhorn-outage-cyberattack-staffing-platform/), a reminder that a single intrusion can stop daily business operations.

## What shoppers and employees should do now

Most of the practical steps are simple.

- Before you plan a pickup or delivery, open your store’s app or website and confirm it loads and shows open time slots. Restoration was phased and varied by region, so check your own banner rather than assuming it is back.
- Be wary of unexpected emails or texts about the outage, refunds, coupons or account problems. Open the official app or type the store address yourself instead of tapping links.
- If you use an app or loyalty account and reuse that password elsewhere, change it now and turn on multifactor authentication if the app offers it. This is general guidance. The sources reviewed do not show the company asking customers to reset passwords.
- Employees should treat unexpected prompts about timekeeping or pay systems as suspicious. Confirm any such request through internal IT or HR contacts before entering credentials.

## What to watch next

Ahold Delhaize’s next update will matter more than the last one. If it names the attack method, says whether ransomware was involved and confirms the status of every US banner, much of the uncertainty will end. If it does not, the company will face the same questions Beaumont raised about timing and transparency.

Three other threads deserve attention. Whether any US regulator opens an inquiry is unknown, and no US regulatory action appeared in the sources reviewed. Albert Heijn’s Friday restart will show whether the European recovery holds, and the €120 million to €150 million estimate will stay an outside number until the company reports its own losses. For shoppers, the test is simpler: whether the app on their phone works on the day they need it.

## Frequently asked questions

### Is my personal data safe after the Ahold Delhaize cyberattack?

Ahold Delhaize says it has no evidence that sensitive customer, associate or partner data was taken, but its investigation is still ongoing. Because the investigation is open, that statement describes what has been found so far rather than a final conclusion. Watch for suspicious messages that mention the outage, and use only official apps and websites.

### When did Stop & Shop and Food Lion online ordering come back?

Websites and apps for Ahold Delhaize USA’s banners returned on Tuesday, October 20, after at least eight days offline. Regional coverage on October 22 reported that websites and online shopping for stores in New England, the Mid-Atlantic and the Southeast were back. Restoration was phased, so check your own store’s app or website before relying on pickup or delivery.

### Did the Ahold Delhaize attack involve ransomware?

Ahold Delhaize has not said whether ransomware or a ransom was involved, and it has not described the attack method. Security researcher Kevin Beaumont criticized the company for not saying ransomware. A ransomware group breached Ahold Delhaize USA Services LLC in November 2024, but the company did not publicly confirm that group’s involvement.

### Were stores closed during the Ahold Delhaize outage?

No. Physical stores stayed open throughout the incident, while websites, apps, online ordering and digital coupons were disrupted. Coverage reports that shoppers who depended on pickup and delivery lost access for about a week and a half.

## Sources

1. [Ahold Delhaize USA Restores Online Grocery Services After Cyberattack](https://progressivegrocer.com/ahold-delhaize-usa-restores-online-grocery-services-after-cyberattack)
2. [Ahold Delhaize says there's no evidence cybersecurity incident compromised personal data](https://www.grocerydive.com/news/ahold-delhaize-adusa-cybersecurity-update/833414/)
3. [Ahold Delhaize Provides Update on Cybersecurity Incident](https://storebrands.com/ahold-delhaize-provides-update-cybersecurity-incident)
4. [Eastern States' Supermarkets Back Online After Cyber Incident (Insurance Journal, Oct. 22, 2026)](https://www.insurancejournal.com/news/east/2026/10/22/890010.htm)
5. [Ahold Delhaize cybersecurity incident disrupts Stop & Shop, Food Lion](https://www.foxnews.com/tech/major-us-grocery-chains-hit-cybersecurity-incident)
6. [Supermarket Chain Ahold Delhaize Caught in Cyber Incident (BankInfoSecurity)](https://www.bankinfosecurity.com/supermarket-chain-ahold-delhaize-caught-in-cyber-incident-a-33072)
7. [Ahold Delhaize confirms 'malicious actions' behind cyber outages affecting grocery brands (The Record)](https://therecord.media/ahold-delhaize-cyberattack-grocery)
8. [Ahold Delhaize Cyberattack: 8 Brands, US vs EU Status (Tech Insider)](https://tech-insider.org/ahold-delhaize-hack-8-brands-eu-recovery-2026/)
9. [Cyberattack attempt cost Albert Heijn up to €150 million, experts say (NL Times)](https://nltimes.nl/2026/10/20/cyberattack-attempt-cost-albert-heijn-eu150-million-experts-say)