Ahold Delhaize, one of the world's largest food retail chains, confirmed that last week's cyberattack disrupted services at stores across Europe and the United States.
Right before the cyberattack was disclosed, customers couldn't use websites, apps, and customer service platforms at Albert Heijn, Etos, and Gall & Gall stores in the Netherlands, and Delhaize in Belgium, while employees at the Stop & Shop American regional supermarket chain reported having trouble accessing their schedules and pay stubs.
When BleepingComputer asked right after the incident whether it also affected both corporate and store systems and whether any devices were encrypted during the attack, an Ahold Delhaize spokesperson redirected us to the company's statement.
In a Monday update, Ahold Delhaize said the cybersecurity incident announced last week forced it to take some systems offline, including its brands' websites and apps, causing service issues, although stores remained open to serve customers.
While most store websites and apps in Central and Southeastern Europe (CSE) are now online, the company says it's still working to restore some systems and services for European and US brands that remain down.
"Albert Heijn's website and app are back online, with home deliveries expected to resume from Friday, October 23. The Etos and Gall & Gall websites are also available for customers. E-commerce services at our Ahold Delhaize USA brands are expected to come back in the coming days. In Belgium, e-commerce is now fully operational," Ahold Delhaize said.
"As part of our response, we notified the Dutch National Cyber Security Centre (NCSC) within 24 hours of discovering the malicious activity and have continued to provide timely updates to the NCSC, law enforcement and other relevant regulatory authorities. Today, Ahold Delhaize has filed a formal police report with the Dutch police.
The retail giant did not share further details that could interfere with response efforts or compromise security measures protecting its systems, but noted that an ongoing investigation has not yet found evidence that sensitive customer, associate, or partner data was stolen in the incident.
"Although this incident was caused by the malicious actions of others, we apologize for the inconvenience this has caused - especially to our customers," said Frans Muller, President and CEO of Ahold Delhaize.
This is the second major cyberattack to affect Ahold Delhaize's systems in recent years, after the personal, financial, and health information of over 2.2 million individuals was stolen in a November 2024 attack that impacted the company's U.S. systems and was claimed by the ransomware group INC Ransom.
The multinational retailer employs more than 384,000 people and operates 9,551 stores serving 77 million customers each week across the United States, Europe, and Indonesia.
Once attackers have valid credentials, only 37% of their actions are blocked
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.