Ahold Delhaize restores services in phases after cyber incident

Ahold Delhaize says it detected suspicious activity in its IT infrastructure and took some systems, brand websites, and apps offline as a precaution. In an October 19 update, the company said its investigation confirmed the activity resulted from malicious actions by others. It said it notified the Dutch National Cyber Security Centre within 24 hours of detection and filed a formal report with Dutch police on October 19. (Ahold Delhaize incident update)

The service picture varies by market. In its October 19 statement, Ahold Delhaize said Albert Heijn’s website and app were back online, with home deliveries expected to resume October 23. The Etos and Gall & Gall websites were available, Belgian e-commerce was fully operational, and most sites and apps in the Central and Southeastern Europe region were available. The company then expected U.S. e-commerce services to return in the coming days. On October 20, Grocery Dive reported that Ahold Delhaize USA’s banner websites and apps had returned that morning. CT Insider separately reported, citing a Stop & Shop spokeswoman, that its website and app were available again for online delivery and pickup orders. These reports establish restoration for U.S. digital services, including Stop & Shop ordering, but do not establish that every brand restored every e-commerce feature. Stores remained open while the company continued a phased restoration to support grocery distribution. (Ahold Delhaize incident update; Grocery Dive; CT Insider; RetailDetail)

The company said it currently has no evidence that sensitive customer, associate, or partner data was taken. It has not disclosed an entry path or technical details while its investigation continues. Reuters reported that the Dutch National Cyber Security Centre saw no reason to believe the Ahold Delhaize incident was directly linked to separate cyberattacks affecting French supermarket refrigeration systems. (Ahold Delhaize incident update; Reuters)

The current public record establishes malicious activity and a broad service-availability response. It leaves the intrusion path and data impact unresolved. For retailers, the incident shows how a protective shutdown can affect websites, apps, e-commerce, and distribution across several brands while physical stores keep operating. Mapping shared identity, ordering, and fulfillment dependencies helps teams plan recovery checkpoints and customer alternatives before an incident forces those choices.