Ahold Delhaize: cyberattack forced IT systems, websites and apps offline across US and European brands (no CVE)
Severity: high · Patch status: no-fix-needed · Since 2026-10-12
Dutch grocery multinational Ahold Delhaize confirmed a cyberattack by 'malicious actions of others' forced it to proactively take IT systems, websites and apps offline, affecting most of its US and European brands. The incident was first disclosed October 12, 2026; the company notified the Dutch NCSC and filed a police report. Physical stores remained open, and no evidence of theft of sensitive customer, associate, or partner data has been found. Albert Heijn's site and app are back online with deliveries resuming Friday; US brand e-commerce (Food Lion, Giant Food, Martin's, Hannaford, Stop & Shop) was expected to recover in coming days. This is the company's second attack in two years: a November 2024 INC Ransom breach compromised data of over 2.2 million people. Possible links to attacks on French supermarket refrigeration controllers are unconfirmed.
What to do
- Review network segmentation and isolate retail/e-commerce systems from corporate networks to limit blast radius from intrusions
- Verify no data exfiltration via log analysis and egress monitoring before restoring services
- Report incidents to national CSIRTs and law enforcement promptly, as Ahold Delhaize did with the Dutch NCSC and police
- Prepare manual fallback procedures (in-store operations, prescription filling, deliveries) for e-commerce outages
- Assess whether third-party or refrigeration/OT systems are exposed, given reported attacks on French supermarket refrigeration controllers
Sources
All live incidents on Threat Watch
