Threat intel

Ahold Delhaize, the Dutch group behind Albert Heijn, Delhaize, Food Lion, Stop & Shop, Hannaford and both Giant chains, is dealing with what it calls a cybersecurity incident. Albert Heijn reported problems from Sunday afternoon, October 11. On Monday, October 12, the group said it had found a security issue in its network and had taken some systems offline to protect them. Websites, apps and online ordering went dark at five US banners and at Albert Heijn, Etos and Gall & Gall in the Netherlands, and Albert Heijn stopped work at several distribution centres.

Stores stayed open and their tills kept working, but by Tuesday some Dutch shelves were running empty of fresh products. On October 13 the company said it had no evidence so far that customer or employee data was taken, and that a controlled restart of some systems had begun. It has not said what happened, which systems it switched off, or when everything will be back. Anyone who runs retail or logistics IT, or exchanges data with a large retailer, can learn from what this shutdown cost and what it leaves partners to check.

What the company has confirmed

The group's first statement, on October 12, said it was working with internal teams and outside cybersecurity experts to investigate and to restore affected systems safely. Its October 13 update repeated that there was no evidence "at this moment" that customer and associate data was taken, and said progress allowed a controlled restart of certain systems. Reuters carried the same position. Treat it as preliminary: the investigation is still running, and Albert Heijn first called it an "IT incident" before the parent used the word cybersecurity.

In the United States, Stop & Shop said its stores, pharmacies and fuel stations were open as normal. Its website, app and Peapod home delivery were not, and it pointed customers to Instacart, DoorDash and Uber Eats, while online orders that could not be filled were refunded. In Belgium the impact was smaller: Delhaize took online orders again within days, with fewer delivery slots. Bol.com, the group's online marketplace, appeared to keep running.

The Netherlands took the hardest hit. Albert Heijn's chief executive, Margaret Versteden-van Duijn, told the public broadcaster NOS that seven distribution centres had been stopped as a precaution. Reports disagree on the number: other outlets say she would not give one, and RTL Nieuws reported an email to suppliers describing almost all distribution centres as affected. She warned that fresh products would run short first, while long-life goods, frozen food and bread should stay better available. The Bonus card and Mijn AH loyalty systems also stopped working.

How one shutdown reaches the shelf

A grocer runs on a chain of systems that pass data to each other on a tight schedule. Store sales and stock counts feed replenishment, which produces orders for the distribution centres; the warehouse management system turns those orders into pick lists and truck loads; and a central pricing system pushes the week's prices and promotions to tills and electronic shelf labels. Switching off the systems in the middle of that chain stops goods moving even when the tills at either end still work.

The Dutch symptoms show the chain breaking in that order. On Monday the electronic shelf labels in Albert Heijn stores still showed the previous week's promotion prices, while the tills charged the current week's offers, according to NOS and local outlet 1Almere. The price data had reached the tills before the shutdown, but updates to the labels had stopped. Fresh produce, with the shortest shelf life and the most frequent deliveries, ran out first because it depends on daily orders flowing through the distribution centres.

In the US, orders through Instacart, DoorDash and Uber Eats kept flowing because those platforms take orders on their own systems and use store staff and stock, while Ahold's web shop, app and Peapod run on its own network. Stores and tills kept running while the online and logistics layer went dark, which suggests the two could be separated on its network.

What is known about the attacker

Very little. No group has claimed the attack, and the company has not confirmed ransomware, data theft or a way in. NOS, citing unnamed sources in the security sector, reported that Albert Heijn saw traffic from attackers and knows of several servers used in the attack, in the United States, Poland, Moldova and Turkey. Server locations say little about who is behind it, since attackers rent or hijack servers abroad. The same report said staff switched systems off as the suspicious traffic arrived, which may have stopped the intruders going further. Ahold Delhaize has confirmed none of this.

There is a precedent. In November 2024 Ahold Delhaize took US systems offline after a breach that hit pharmacies and e-commerce at several banners, and in April 2025, after the INC Ransom group listed it on its leak site, the company confirmed that files had been taken from internal US business systems. Read the current "no evidence of data theft" with that in mind.

What retailers should settle before their own incident

Ahold could switch off its online and logistics systems and keep stores trading. Find out whether you could do the same: for each store and warehouse system, write down what it needs to run for a day, such as the directory it signs in to, the pricing feed, the payment gateway and the warehouse management system. Then block those links for a few hours at one site and see what breaks. If tills stop when head office goes offline, fix that dependency first.

Two decisions belong on paper now. The first is who can order a shutdown, with a deputy, and on which triggers, such as confirmed hands-on-keyboard access by an outsider or encryption starting on any server. The second is the fallback for each warehouse and store: offline pick lists, standing orders for fresh lines based on recent volumes, carrier phone numbers, and a rule for honouring the till price when shelf labels go stale. Keep third-party delivery accounts active and know who can raise their stock limits; in this case they were the only online channel left in the US.

What suppliers and partners should check now

If you send goods, invoices or data to any Ahold Delhaize business, treat your connection to them as in scope until they say otherwise. List every EDI (electronic data interchange) link, supplier portal account, VPN tunnel, API key and shared mailbox that touches their network, then:

1. Review logs for those connections from the start of October. In VPN and firewall logs, look for sessions from their address ranges at unusual hours or volumes; in your identity provider, sign-ins by partner guest accounts; on file transfer servers, transfers outside the normal order cycle.
2. Ask your contact for indicators of compromise (IP addresses, domains, file hashes) once they can share them, and search your logs for them.
3. Rotate credentials and API keys their systems hold for yours, and disable partner accounts you do not need while they are down.
4. When they reconnect, reconcile orders, deliveries and invoices from the outage window before trusting automatic flows again.
5. Confirm any request to change bank details by phone, on a number you already had. Fraudsters use public incidents as cover.

Our security operations team can review partner connections and logs for signs of spread from an affected customer or supplier, and our safeguarding and hardening work covers the segmentation and fallback planning that let stores keep trading while other systems are off. Open the chat and Yaali, our AI agent, will pass your question to the engineer who would run the work.

---

Sources: Ahold Delhaize, October 12 statement, Ahold Delhaize, October 13 update, SecurityWeek, Reuters via The Star, The Boston Globe, Grocery Dive, WWLP, NOS on distribution centres, NOS on shelf prices, NOS on the restart, NOS on foreign servers, DutchNews, Security.NL, 1Almere, Retailtrends, RetailDetail, VRT NWS, NL Times, BleepingComputer on the 2025 data theft, Cybersecurity Dive on the 2025 data theft.