Ahold Delhaize Cyberattack: Food Lion, Stop & Shop Hit

Ahold Delhaize, the Zaandam-based parent of Food Lion, Stop & Shop, Hannaford and Giant Food, is working to restore systems after disclosing a "security issue within its network" that forced it to take some systems offline on October 12, 2026. Three days later, shoppers at several of the company's US and European grocery banners are still running into disrupted online ordering, degraded apps, and in some cases suspended delivery slots, even as the company says its physical stores remain open and serving customers.

This is the second disclosed cybersecurity incident at the company in under two years, following a November 2024 attack that Ahold Delhaize later confirmed involved theft of personal data belonging to more than 2 million people connected to its US operations. The new incident has not been characterized that way — Ahold Delhaize has been careful, in two statements so far, to call it a "cybersecurity incident" or "security issue" and to say explicitly that it has found no evidence of data theft. This article sticks to what the company itself has confirmed in its own newsroom statements, and flags clearly where facts are still unconfirmed.

What happened

At 08:29 AM Central European time on October 12, 2026, Ahold Delhaize's corporate newsroom published a statement titled "Ahold Delhaize takes precautionary measures following cybersecurity incident". The company said: "Ahold Delhaize is experiencing a security issue within its network. Our teams are taking steps to assess and mitigate the issue. This includes taking some systems offline to help protect them. At this time, our stores are open and serving customers." The statement added that "protecting our infrastructure in the best interest of our customers, associates and partners is a top priority."

Notably, the October 12 release carried a formal flag: Ahold Delhaize disclosed it as containing inside information under Article 7(1) of the EU Market Abuse Regulation — the rule that forces publicly listed companies to disclose, without delay, any information that could significantly affect their share price. That's a legal and financial detail as much as a security one: by invoking MAR Article 7(1), Ahold Delhaize's own disclosure team judged the incident material enough to move markets, which is one of the clearest external signals of how seriously the company is treating it, independent of anything a security vendor or outside reporter has said.

The October 13–14 update

A second statement, "Update on Ahold Delhaize's cybersecurity incident," went out on October 13, 2026 at 14:00 Central European time and was marked "Updated: October 14, 2026." It is the company's most recent public word on the incident as of this writing. The key lines:

"As was shared on October 12, 2026, Ahold Delhaize is experiencing a cybersecurity issue within its network... Our teams are working with urgency to investigate the incident and restore affected systems safely... we are in the process of starting a controlled re-launch of certain systems. As part of our response, we are working with relevant internal teams and external cybersecurity experts. We are engaging with the appropriate authorities and other stakeholders as necessary."

On the question everyone searching for this story actually wants answered — was my data stolen — the company's language is specific and limited: "Although our investigation is still ongoing, we have no evidence at this moment that customer, associate and partner data was taken in this cybersecurity incident." That is not a clearance. It is a snapshot of an active investigation, phrased in the careful, lawyer-reviewed way large companies phrase statements about incidents they do not yet fully understand. Ahold Delhaize also confirmed that "our brands' stores across Europe and the United States remain open and are serving customers," while acknowledging that "the impact of our preventative measures differs per brand" — i.e., some banners have been hit harder online than others, without specifying which.

As of publication, Ahold Delhaize's own newsroom shows no statement dated after October 14, 2026 that updates or supersedes this one.

Who is affected: Ahold Delhaize's brands

Ahold Delhaize is a holding company, not a single retail brand, so "Ahold Delhaize hack" headlines can be confusing if you don't shop under that name. Per the company's own brands page, it operates 17 local grocery, drugstore and e-commerce brands across nine countries. In the United States, that's Food Lion, Giant Food, The Giant Company, Hannaford and Stop & Shop. In Europe and Indonesia, the group's banners include Albert Heijn and Etos and Gall & Gall (Netherlands), Delhaize (Belgium), bol (Netherlands/Belgium), Albert (Czech Republic), Alfa Beta (Greece), Maxi (Serbia), Mega Image and Profi (Romania), and Super Indo (Indonesia).

Ahold Delhaize's own statements do not break out which specific banners' websites, apps or online-ordering systems were taken offline or when each was restored — the company says only that "the impact of our preventative measures differs per brand." Shoppers who rely on a specific chain's app, curbside pickup or delivery slot booking should check that banner's own site or app directly for current status rather than assuming the incident is fully resolved everywhere, since the company has confirmed the effects are uneven across its brands.

What is not confirmed

It's worth being precise about what Ahold Delhaize has not said, because incident coverage tends to harden into "confirmed" facts that the source statements never actually state:

• No confirmed data breach. The company's own language is "no evidence at this moment that customer, associate and partner data was taken." That is an active-investigation snapshot, not a clean bill of health, and not a confirmed breach either.
• No named attacker or method. Ahold Delhaize has not publicly attributed the incident to a specific threat actor, ransomware group, or attack technique. Any such attribution circulating elsewhere is not something the company itself has confirmed.
• No confirmed root cause. The company says it is working with "external cybersecurity experts" and has engaged "appropriate authorities," which signals a formal incident-response and likely regulatory process, but it has not disclosed how systems were compromised.
• No full list of affected systems or brands. Beyond "some systems," the company has not itemized which applications, databases or store systems were taken offline.

A second incident in under two years

This is not Ahold Delhaize's first disclosed cybersecurity incident. In November 2024, the company's US arm disclosed a cyberattack that it later confirmed, in an updated statement, involved files taken from some internal US business systems — ultimately affecting the personal information of millions of people connected to its US operations, with notifications sent as legally required. That incident disrupted pharmacy systems and e-commerce at several US banners for weeks.

The 2024 incident is a useful point of comparison precisely because it shows how Ahold Delhaize's own language evolves once an investigation firms up: initial statements described a "security issue," and only later, once forensic work was complete, did the company confirm specific data was taken and begin notifying affected individuals. Readers should expect that same pattern could play out again here — today's "no evidence" language is not necessarily where this story ends. It's a reminder of why zero trust security principles have become a standard reference point for large retailers rebuilding network defenses after repeat intrusions: segmenting systems so that a compromise in one part of the network doesn't cascade into point-of-sale, loyalty or e-commerce platforms elsewhere.

Why the EU market-abuse flag matters

For a US shopper, the EU Market Abuse Regulation detail might look like corporate housekeeping, but it's a genuine tell. Ahold Delhaize is listed on Euronext Amsterdam, and Article 7(1) of the regulation obliges issuers to publicly disclose "inside information" — facts not yet public that a reasonable investor would likely use as part of the basis of an investment decision — as soon as possible. By tagging its October 12 release this way, Ahold Delhaize's leadership effectively told its own shareholders, in writing, that this incident could move the stock. That is a much higher bar than a routine IT outage notice, and it is consistent with how seriously the company has treated the 2024 incident in hindsight.

What next for shoppers

There is no confirmed data exposure to act on yet, but a disclosed network intrusion at a company holding loyalty-program and payment-adjacent data is still worth a few sensible precautions while the investigation continues:

• Check your specific banner's site or app before ordering. Food Lion, Stop & Shop, Hannaford, Giant Food, Albert Heijn and the rest are not uniformly affected — confirm current online-ordering and delivery-slot availability directly rather than assuming full restoration.
• Watch for phishing that name-drops the incident. Attackers routinely exploit real breach news with fake "verify your account" or "your order was affected" emails and texts. Don't click links in unsolicited messages referencing this incident; go to the retailer's site or app directly instead.
• Keep an eye on loyalty and payment accounts. If you use a banner-specific loyalty card, rewards app or stored payment method, review recent activity and enable multi-factor authentication where the app supports it — a passkey, where offered, removes the password-reuse risk entirely.
• Don't assume "no evidence" means "cleared." If Ahold Delhaize's investigation later confirms data was accessed — as happened with the 2024 incident — the company has said it will notify affected individuals as required by law. Watch for official communications directly from your grocery banner or from Ahold Delhaize's newsroom, not third-party summaries.
• Be alert to AI-generated scam calls or messages. Large, well-publicized incidents are a known trigger for opportunistic fraud, including deepfake voice scams impersonating customer service.

This is a developing story. Ahold Delhaize has said it will continue to provide updates through its own newsroom as the investigation progresses; this article reflects the company's most recent public statement as of October 17, 2026, and will be revisited if the company issues a further update.

Every fact in this article attributing a claim to Ahold Delhaize is drawn directly from the company's own newsroom statements, linked above, or its public corporate pages. No data breach, attacker identity or root cause is confirmed here beyond what the company itself has stated, because none of that has been confirmed by Ahold Delhaize at the time of writing.

Written bySana Qureshi

Sana Qureshi runs the security and privacy desk. She reports on actively exploited vulnerabilities, vendor patches and data breaches, and covers the password managers, VPNs and authentication tools readers use to protect themselves. Her alerts cite vendor advisories, CISA and the CVE record directly.

More from Sana QureshiAll Security & Privacy coverage