A cyberattack forced grocery giant Ahold Delhaize to take parts of its IT infrastructure offline, disrupting digital services across the US and Europe while the company works to restore operations.
The company, which owns grocery brands including Food Lion, Stop & Shop, Giant Food, and Albert Heijn, initially disclosed the cybersecurity incident on Oct. 12. On Oct. 19, it confirmed that the suspicious activity resulted from malicious actions but did not identify those responsible.
The disruption highlights how a cyberattack can affect services beyond a company's internal systems, interrupting online shopping, grocery deliveries, and employee operations even when physical stores remain open.
How the Ahold Delhaize attack unfolded
Ahold Delhaize said it took certain IT systems offline after detecting suspicious activity on Oct. 12, disrupting websites, apps, and online shopping services across several grocery brands.
The shutdown disrupted websites, apps, and online shopping services across several brands in the US and Europe. According to BleepingComputer, some US employees reported difficulties accessing work schedules and pay information, while online orders took a hit. Physical stores, however, remained open.
CEO Frans Muller defended the shutdown as a precaution to protect the company's infrastructure, while apologizing for the inconvenience to customers, employees and business partners.
On Oct. 19, Ahold Delhaize confirmed that the activity was malicious and said it had filed a formal police report. The company has also notified the Dutch National Cyber Security Center.
Some services had been restored by Oct. 19, although recovery remained ongoing. Albert Heijn's home deliveries are expected to resume on Oct. 23.
The company has not identified the attackers, disclosed the initial access method, or confirmed whether ransomware was involved. It also said it had no evidence at that point that sensitive customer, employee, or partner information had been stolen.
BleepingComputer notes that this is the second major cyber incident Ahold Delhaize has faced in two years. A separate attack in November 2024 exposed information belonging to more than 2.2 million people.
Authorities see no link to French supermarket attacks
The Ahold Delhaize incident coincided with separate cyberattacks targeting supermarket refrigeration systems in France, raising questions about whether the incidents could be connected.
The timing drew attention to a separate cyberattack in France, where hackers manipulated internet-connected refrigerators and freezers at supermarkets, spoiling food and sparking fires by raising temperatures.
Reuters reported that the two incidents coincided, prompting questions about whether they could be connected.
Dutch authorities, however, said there was no reason to believe the Ahold Delhaize incident was directly linked to cyberattacks in other countries.
Service disruption is now part of the risk
The Ahold Delhaize incident highlights a cost of cyberattacks that often receives less attention than stolen data or ransom demands: losing access to services people depend on.
Even without confirmed data theft or publicly established ransomware involvement, the disruption affected online shopping, grocery deliveries and employee services across multiple brands and countries.
The incident also illustrates the difficult balance between containment and business continuity. Ahold Delhaize took systems offline to protect its infrastructure, but those precautions interrupted legitimate operations. Even without confirmed data theft, customers and employees experienced the consequences.
The incident — and several other similar cases — illustrates how the consequences of a cyberattack can spread beyond the systems directly involved, even when there's no confirmed effect on data stores and the full extent of the compromise is unknown.
How businesses can limit disruption during cyberattacks
One core principle of the CIA triad is availability, which underscores the importance of keeping systems and services accessible during a cyberattack.
For enterprises and their security teams, the challenge is not just preventing unauthorized access, but also limiting how much an incident interrupts the services customers and employees depend on.
That is where fast detection, network segmentation, redundancy, and reliable backups become important.
Early detection can limit how far an attack spreads, while segmentation can isolate affected systems without taking entire services offline. Redundant systems and tested backups can also help restore operations when critical infrastructure becomes unavailable.
Ahold Delhaize's response highlights the difficulty of balancing containment with continuity.
Taking systems offline may be necessary to protect the wider environment, but the longer essential services remain unavailable, the greater the operational and customer impact.
The goal, therefore, is not simply to contain an attack, but to do so in a way that minimizes disruption and restores critical services as quickly and safely as possible.
Other news: A malware infection on a Nippon Columbia employee's computer may have exposed approximately 8.7 million customer and employee records belonging to Japanese entertainment company Daiichi Kosho.