Ahold Delhaize Data Breach: What Happened and Who's Affected

Ahold Delhaize, the Netherlands-based parent company of Stop & Shop, Hannaford, Giant Food, Food Lion, Albert Heijn and more than a dozen other grocery brands, confirmed on October 12, 2026 that it is "experiencing a security issue within its network" and has taken some systems offline as a precaution. In an update issued October 13, the company said it has "no evidence at this moment that customer and associate data was taken," though its investigation is still ongoing. Physical stores across Europe and the United States remain open, but the company says the impact of its precautionary measures "differs per brand," and it has not yet detailed which specific websites, apps or ordering systems are affected at each chain.

What happened to Ahold Delhaize

Ahold Delhaize, formally Koninklijke Ahold Delhaize N.V., disclosed the incident in a press release dated October 12, 2026 and published through its corporate newsroom. The company said: "Ahold Delhaize is experiencing a security issue within its network. Our teams are taking steps to assess and mitigate the issue. This includes taking some systems offline to help protect them. At this time, our stores are open and serving customers."

The release was filed as containing "inside information" under Article 7(1) of the EU Market Abuse Regulation — the disclosure rule that applies to Euronext-listed companies when something could materially affect their share price, which signals the company itself treated the incident as significant enough to require immediate public disclosure rather than something it could quietly resolve internally.

A follow-up statement on October 13, titled "Update on Ahold Delhaize's cybersecurity incident," gave more detail on the response. The company said its teams are "working with urgency to investigate the incident and restore affected systems safely," and that it is now "in the process of starting a controlled re-launch of certain systems." It added that it is working with "relevant internal teams and external cybersecurity experts" and is "engaging with the appropriate authorities and other stakeholders as necessary." Ahold Delhaize said it is deliberately withholding further technical detail "that could compromise security measures or interfere with our response efforts" — a common posture for companies in the early, active phase of an incident response.

Neither statement names an attacker, describes how the intrusion occurred, or gives a timeline for full restoration. Both statements apologize for the disruption caused to customers, associates and partners.

Which brands and chains are affected

Ahold Delhaize is the parent of a large portfolio of grocery and retail brands across the United States and Europe, including Stop & Shop, Hannaford, Giant Food, The Giant Company, Food Lion, Albert Heijn, Delhaize, bol, Etos, Gall & Gall, Albert, Alfa Beta, Maxi, Mega Image, Profi, Super Indo and Ena, according to the company's own corporate site.

Importantly, Ahold Delhaize's own statements about the cybersecurity incident do not break the impact down brand by brand. The October 13 update says only that "our brands' stores across Europe and the United States remain open and are serving customers" and that "the impact of our preventative measures differs per brand," adding that "each local brand is working hard to serve its customers and minimize disruption." The company has not published a list of which specific brand websites, mobile apps, online ordering platforms or loyalty systems were taken offline, or for how long.

That means if you're trying to figure out whether a specific banner — Stop & Shop, Hannaford, Giant, Food Lion or Albert Heijn — has its website or app fully working right now, the most reliable thing to check is that brand's own site or app directly, since Ahold Delhaize has not published a brand-level status breakdown as of this writing.

Are Stop & Shop, Hannaford and other stores still open?

Yes — according to Ahold Delhaize's own statements, physical stores have remained open throughout the incident. The October 12 release said "at this time, our stores are open and serving customers," and the October 13 update reiterated that "our brands' stores across Europe and the United States remain open and are serving customers." The company has not said that any store locations were closed as a result of the incident.

What the statements don't clarify is the in-store customer experience in detail — for example, whether point-of-sale systems, self-checkout, pharmacy systems, digital coupons or loyalty-card scanning have been affected at any location. Ahold Delhaize's language focuses on store openness generally rather than describing every system that touches a shopper inside a store.

Was customer data stolen or exposed?

As of the October 13 update, Ahold Delhaize's position is that it has "no evidence at this moment that customer and associate data was taken in this cybersecurity incident," while also stating plainly that "the investigation is ongoing." That is a meaningfully different statement from a confirmation that data is safe — it reflects where the investigation stands at the time the statement was published, not a final conclusion.

Companies in the early days of responding to a network intrusion routinely update this kind of language as forensic work continues, and a "no evidence at this time" statement can change in either direction as more of the network is examined. Ahold Delhaize has not said what categories of data could theoretically be at risk (for example, payment card data, loyalty account details, or employee records), nor has it indicated any timeline for when a more conclusive assessment will be available. Anyone affected should treat this as an open question rather than a resolved one, and watch for further statements from the company.

Why a disclosure under EU market rules matters here

Ahold Delhaize is listed on Euronext Amsterdam, and both of its statements on this incident were filed as "inside information" under the EU Market Abuse Regulation. That designation is reserved for information that could have a significant effect on the price of a company's securities if it became public — it is not a label companies apply to routine IT problems. The fact that Ahold Delhaize used this designation indicates the company itself assessed the incident as materially significant to its business, not merely a minor technical glitch affecting a single website.

This kind of disclosure obligation is part of why publicly traded companies tend to issue short, carefully worded statements early in an incident: they are legally required to inform the market promptly, even before a full investigation is complete, which is also why the statements so far describe actions taken and a general assessment of data risk rather than a full technical post-mortem.

How this compares to other recent breach disclosures

Ahold Delhaize's pattern so far — disclose quickly, say what's known, decline to give technical specifics while an investigation is active, and state what evidence does or doesn't currently exist for stolen data — mirrors the early-stage statements companies have made in other recent incidents Pandromeda has covered, including the Georgia Power data breach and the DriveWealth data breach. In both of those cases, initial statements were later followed by more detailed updates as investigations progressed, and the same is likely here given Ahold Delhaize's own promise to "provide further updates when appropriate."

It's also a reminder that the attack methods behind incidents like this are often mundane rather than exotic — compromised credentials and social-engineering tactics remain among the most common ways attackers get an initial foothold inside a corporate network, as explained in Pandromeda's guides to credential stuffing and social engineering. Ahold Delhaize has not disclosed how its own network was accessed, so none of this should be read as a claim about this specific incident's cause — only as context for how similar incidents typically begin.

Timeline so far

What affected customers should do now

Because Ahold Delhaize has not confirmed that customer data was taken, there is no company-confirmed reason yet to assume your personal information has been exposed. Still, with the investigation ongoing and the scope of affected digital systems not fully detailed, a few precautionary steps are reasonable for anyone who shops at Stop & Shop, Hannaford, Giant Food, Food Lion, Albert Heijn or another Ahold Delhaize brand:

• Check the brand's own site or app directly before assuming online ordering, pickup or delivery is working as normal — Ahold Delhaize has said impact varies by brand, and has not published a brand-by-brand status page.
• Watch your statements for your grocery loyalty account, any stored payment cards, and pharmacy or delivery accounts tied to these brands, and report anything unfamiliar to your bank or the retailer.
• Be alert for follow-up phishing attempts. Incidents like this are often followed by scam emails or texts impersonating the affected company; don't click links in unsolicited messages claiming to be from Ahold Delhaize or one of its brands asking you to "verify" your account.
• Don't reuse passwords across your grocery, pharmacy and financial accounts. If you're unsure how attackers exploit reused or weak credentials, Pandromeda's explainer on credential stuffing breaks down why that matters.
• Watch for malware-flavored scams that may piggyback on news of the incident, such as fake "security update" emails; Pandromeda's guide on spotting and removing malware covers the warning signs.
• Follow Ahold Delhaize's own newsroom for updates rather than relying solely on secondhand reports, since the company has said it will share more "when appropriate."

What's next

This remains an active, developing situation. Ahold Delhaize has committed to further updates, and key questions — including exactly which brand websites and apps were affected, how long full restoration will take, how the intrusion occurred, and whether the "no evidence" finding on customer data holds up as the investigation continues — remain open. Pandromeda will update this article as Ahold Delhaize publishes additional statements.

Written bySana Qureshi

Sana Qureshi runs the security and privacy desk. She reports on actively exploited vulnerabilities, vendor patches and data breaches, and covers the password managers, VPNs and authentication tools readers use to protect themselves. Her alerts cite vendor advisories, CISA and the CVE record directly.

More from Sana QureshiAll Security & Privacy coverage