Ahold Delhaize's newsroom post today is short on purpose, and it's labeled as inside information under the EU Market Abuse Regulation. The company says it is "experiencing a security issue within its network," that teams are assessing and mitigating it, and that some systems were taken offline to protect them. Physical stores are open (Ahold Delhaize).
That still leaves a long list of what broke. BleepingComputer reports employees at Stop & Shop struggling with schedules and pay stubs, and customers unable to use websites, apps, and customer-service platforms at Albert Heijn, Etos, and Gall & Gall in the Netherlands and Delhaize in Belgium. An internal Food Lion memo, also reported by BleepingComputer, flagged an IT outage and warned stores may be unable to shop, stage, or hand off online orders.
Scale matters here. Ahold Delhaize runs more than 9,400 stores across Europe, the U.S., and Indonesia, with brands that include Food Lion, Stop & Shop, Giant Food, and Hannaford in the U.S. Net sales were over $104 billion in 2024 (BleepingComputer). Cause of the incident, whether devices were encrypted, and whether customer or associate data was taken: Undisclosed. Ahold Delhaize did not immediately answer those questions when BleepingComputer asked.
This is the group's second major cyber event in recent years. In November 2024, INC Ransom claimed a ransomware attack on U.S. systems that later notifications put at more than 2.2 million individuals' personal, financial, and health information (BleepingComputer). What we'd do this morning if we ran retail SOC for one of these banners: treat the outage as a containment move, not proof of recovery. Preserve logs from identity, VPN, EDR, and POS back-office before anyone "cleans up," lock privileged accounts that look newly used, and ask corporate whether payment, pharmacy, and loyalty systems were in the offline set. Do not assume green registers mean the blast radius is known.