Quick Answer
Ahold Delhaize has taken some systems offline after identifying a security issue within its network, while saying its stores remain open and continue serving customers. The company has not identified an attacker, ransomware group, or data exposure. Customers should treat website outages and unexpected account messages cautiously, use official channels, and wait for confirmed incident updates before sharing information.
Key Takeaways
- Ahold Delhaize disclosed the cybersecurity incident on October 12, 2026.
- The company took some systems offline as a protective measure.
- Stores remained open and were serving customers when Ahold Delhaize issued its statement.
- Websites for five Ahold Delhaize USA grocery banners were unavailable Monday morning.
- No attacker, ransomware group, or customer data exposure has been publicly confirmed.
What happened in the Ahold Delhaize cybersecurity incident?
The Ahold Delhaize cybersecurity incident involves a security issue within the company’s network that led the retailer to take some systems offline as a precaution. Ahold Delhaize disclosed the incident on October 12, 2026, in a statement posted at 8:29 a.m. Europe/Amsterdam time and described the disclosure as inside information under the EU Market Abuse Regulation. Ahold Delhaize’s incident statement says the company is assessing and mitigating the issue.
The company has not publicly described the event as a ransomware attack or a data breach. That distinction matters because a network security incident can disrupt websites or internal systems without necessarily confirming that customer, employee, payment, or loyalty-account information was accessed. The practical conclusion is that customers should rely on the company’s confirmed statements rather than treating service disruption as proof of a data breach.
| Incident detail | What has been confirmed | What has not been confirmed |
|---|---|---|
| Network security issue | Ahold Delhaize said it identified a security issue within its network. | The precise cause and affected systems. |
| Systems taken offline | Some systems were taken offline as a protective measure. | A complete list of unavailable systems or restoration timeline. |
| Store operations | Stores remained open and continued serving customers when the statement was issued. | That every digital service or local feature is operating normally. |
| Data exposure | No customer data exposure has been publicly confirmed. | Whether the investigation will identify any unauthorized access to data. |
| Attacker identity | No attacker or ransomware group has been publicly identified. | Whether an attacker will be identified during the investigation. |
Ahold Delhaize operates a large grocery business with substantial U.S. operations, which makes a network issue relevant beyond the company’s European corporate operations. The company’s 2025 annual report describes Food Lion as having achieved 53 consecutive quarters of positive comparable sales growth, showing the scale of a major U.S. banner that could be affected by extended digital-service disruption. Ahold Delhaize’s 2025 annual report provides that broader business context.
Which U.S. grocery brands have been affected by the incident?
The Ahold Delhaize cybersecurity incident affected online access for five U.S. grocery banners on Monday morning: Hannaford, Stop & Shop, Giant Food, Food Lion, and The Giant Company. The websites for those banners were unavailable when the outages were observed, which indicates that the protective system actions had visible effects on customer-facing digital services. Grocery Dive documented the unavailable banner websites on October 12.
The website outages do not establish that every service tied to each grocery banner is unavailable. A retailer can isolate selected systems while keeping stores, checkout operations, and other services running. The most important point for customers is that an unavailable site may prevent access to routine online tools, but it does not by itself confirm a broader compromise of an individual account.
Food Lion, Stop & Shop, Giant Food, Hannaford, and The Giant Company customers should check the official website or verified customer-service channels for their own banner before assuming a delivery order, account feature, or online promotion is available. Customers facing an urgent grocery need should confirm local store hours and in-store service directly with the relevant store.
Are Food Lion, Stop & Shop, and Giant stores still open?
Ahold Delhaize said its stores remained open and were serving customers when the company issued its October 12 statement. The company’s confirmation is significant because a cybersecurity response can require system isolation without requiring a full store closure. Customers can therefore distinguish between confirmed store operations and the separate online-service outages reported for the U.S. banners.
Store availability can still vary by location and by the particular service a customer needs. Grocery stores use different systems for in-person shopping, online ordering, loyalty accounts, digital coupons, and customer support, so a functioning store does not guarantee that every digital feature is working normally. The practical response is to confirm the specific service you need before making a trip or placing an order.
Customers who use digital coupons, saved shopping lists, pickup orders, or online account tools may encounter interruptions while the company keeps systems offline. A temporary outage can be inconvenient, but customers should avoid creating duplicate accounts or repeatedly submitting the same order, because those actions can create confusion once systems resume normal operation.
Has Ahold Delhaize confirmed a data breach or ransomware attack?
Ahold Delhaize has not confirmed a data breach, ransomware attack, attacker identity, or ransomware group in its public notice. The company described the event as a security issue within its network and said it was assessing and mitigating the situation. A report on the affected U.S. portfolio likewise noted that no attacker, ransomware group, or data exposure had been publicly identified at publication time. BleepingComputer’s incident coverage identifies Food Lion, Stop & Shop, Giant Food, and Hannaford among the company’s U.S. brands.
The absence of a public data-exposure confirmation does not prove that no information was accessed. Incident investigations often take time because security teams must determine which systems were involved, what data those systems contained, and whether evidence shows unauthorized access or removal. The appropriate conclusion is not to assume either safety or exposure before Ahold Delhaize provides a specific update.
Customers should be especially cautious about messages that claim a breach has been confirmed, offer compensation, or ask for passwords, payment details, verification codes, or Social Security numbers. Cybercriminals often use public concern around major incidents to make phishing messages appear credible. Readers concerned about recent retail-related exposure can also compare the facts in this incident with another customer account breach disclosure, where the organization publicly described the affected accounts.
Why did Ahold Delhaize take systems offline?
Ahold Delhaize took some systems offline as a protective measure while it assessed and mitigated the network security issue. Isolating systems can limit the spread of an intrusion, reduce access to connected services, and preserve the environment investigators need to examine. The company has not disclosed which specific systems were taken offline, so it would be inaccurate to assume that a particular website, payment service, or customer database was the source of the incident.
Taking systems offline can create short-term disruption because modern grocery operations rely on connected digital services. Those services can include websites, account tools, online ordering, inventory systems, and internal business platforms. The benefit of isolation is that it gives the company more control while it investigates, although customers may see outages or reduced online functionality in the meantime.
The Ahold Delhaize response also shows why a website outage should be treated as an operational symptom rather than a complete explanation. A customer-facing site can be unavailable because the company intentionally disabled a supporting service, not because the site itself was directly attacked. Customers should avoid drawing conclusions about payment-card security or account exposure until the company provides evidence-based details.
What should Ahold Delhaize customers do now?
Ahold Delhaize customers should use official grocery-banner websites, verified mobile apps, and known customer-service phone numbers for updates during the incident. Do not follow links in unexpected emails, texts, or social media messages that claim to offer outage updates, refunds, account verification, or special compensation. A public cybersecurity incident can create an opportunity for phishing because fraudulent messages can borrow the names of familiar grocery brands.
Customers should also avoid sharing passwords, payment information, one-time codes, or identity details in response to an unsolicited message. A legitimate organization does not need a customer’s existing password or a one-time security code to confirm that the customer owns an account. Customers who reuse a grocery-account password elsewhere should change that password at the other account first, then use a unique replacement password for each service.
A password manager can make unique account credentials more practical, particularly for shoppers who maintain accounts across multiple retailers, banks, and delivery services. Readers evaluating account-protection options can review the real limits of free password manager plans before choosing a tool. The sensible approach is to secure the accounts you control without claiming that your individual account was exposed.
- Visit the grocery banner’s official website by typing the address yourself or using a saved bookmark.
- Check whether the banner has posted a customer notice about website access, ordering, or account services.
- Review recent account activity when the relevant online service becomes available.
- Change a reused password if the same password protects another account.
- Contact the grocery banner through a verified support channel if you see an unfamiliar order, account change, or payment issue.
What should customers avoid doing during the incident?
Ahold Delhaize customers should avoid responding to unverified incident notices, creating duplicate orders, and posting account details publicly while services are disrupted. A scammer can use a recognizable retailer name, an outage notice, and a sense of urgency to pressure a customer into sharing information. The safest approach is to independently navigate to an official service rather than trusting a link delivered in an unexpected message.
Customers should also avoid assuming that every unavailable service reflects an account problem. A banner website may be down because of the company’s network safeguards, and repeatedly attempting password resets or account recovery can make access more difficult once normal service returns. Customers who cannot sign in should wait for an official update unless they have evidence that their own account has been changed.
Customers who notice unauthorized charges, unfamiliar online orders, or suspicious changes to a grocery account should document the issue and contact the retailer through a verified channel. Contact the relevant bank or card issuer promptly if an unfamiliar payment charge appears. Stop and seek direct support rather than attempting to resolve a possible financial-account problem through an unsolicited email, text, or social media account.
What happens next in the Ahold Delhaize cybersecurity incident?
Ahold Delhaize will likely provide further updates after its assessment establishes more about the security issue and the systems involved. The company has confirmed that it is assessing and mitigating the incident, but it has not published a timeline for restoring affected services or a detailed explanation of the event. Customers should expect confirmed information to develop in stages rather than all at once.
The next meaningful update would clarify whether the company identified the cause of the security issue, whether additional systems were affected, and whether any personal or customer information was involved. Those details matter because they determine whether customers need to take steps beyond ordinary phishing awareness and password hygiene. Until then, an outage remains an outage, not proof that customer data was accessed.
The Ahold Delhaize cybersecurity incident also illustrates why timely, specific incident communication matters for large consumer services. Customers need clear information about store access, online ordering, account security, and any confirmed exposure. The practical response is to watch for notices from Ahold Delhaize and the individual grocery banners, while treating unsupported social-media claims as unverified.
FAQ
Did Ahold Delhaize confirm a data breach?
Ahold Delhaize has not confirmed a data breach in its October 12, 2026, public statement. The company said it was responding to a security issue within its network and did not identify a data exposure.
Are Food Lion stores open during the cybersecurity incident?
Ahold Delhaize said its stores remained open and were serving customers when it issued its statement. Food Lion customers should still confirm local services if they need online ordering, digital coupons, or another specific feature.
Why are Stop & Shop and Giant websites unavailable?
Stop & Shop and Giant websites were among five Ahold Delhaize USA banner sites reported unavailable on Monday morning. The company said it took some systems offline as a protective measure while assessing the network security issue.
Should customers change their grocery account passwords?
Customers should change a grocery account password if the same password is used on other accounts. Ahold Delhaize has not confirmed that customer account information was exposed, so a password change is a precaution rather than a response to a confirmed breach.
How can customers avoid Ahold Delhaize incident scams?
Customers can avoid incident scams by using official websites and verified support channels instead of links in unexpected texts, emails, or social-media messages. Do not provide passwords, payment details, or one-time security codes to anyone who contacts you unexpectedly.