Ahold Delhaize: cyberattack, systems offline in Europe and US

Ahold Delhaize, the Dutch-Belgian food retail group, has confirmed that the IT outages that began last week were caused by the malicious actions of others. To contain the attack, the company shut down websites, apps and other IT systems at most of its brands in Europe and the United States. The Record, The Register, BleepingComputer and SecurityWeek report this, citing the company’s update of Monday, 19 October 2026.

What happened

According to The Register and SecurityWeek, on 12 October Ahold Delhaize disclosed a “security issue” within its network and took some IT systems offline. BleepingComputer reports that, shortly before the announcement, customers of Albert Heijn, Etos and Gall & Gall in the Netherlands and of Delhaize in Belgium could not use websites, apps and customer service, while employees of the US chain Stop & Shop had trouble accessing their schedules and pay stubs.

In its 19 October update the company confirmed that:

• taking systems offline, including websites and apps, was a precautionary measure that affected most brands in Europe and the United States; according to CEO Frans Muller, the investigation so far confirms it was the right decision;
• all physical stores remained open throughout the incident;
• the investigation, still ongoing, has found no evidence that sensitive customer, associate or partner data was stolen;
• the Dutch NCSC was notified within 24 hours of discovering the malicious activity and has received updates, as have law enforcement and other relevant authorities; on 19 October the company filed a formal police report with the Dutch police.

Restoration

Restoration is proceeding in phases. As of 19 October:

• the Albert Heijn website and app are back online, with home deliveries expected from Friday, 23 October;
• the Etos and Gall & Gall websites are available;
• in Belgium e-commerce is fully operational again, and in Central and Southeastern Europe most websites and apps are online;
• e-commerce at the US brands (Food Lion, Giant Food, Martin’s, Hannaford and Stop & Shop) is expected back “in the coming days”, with no specific date.

According to BleepingComputer, the group has more than 384,000 employees and 9,551 stores in the United States, Europe and Indonesia, serving 77 million customers a week.

What we don’t know

Public technical information is very limited. The company said it would not share details that could compromise security measures or interfere with its incident response. In particular:

• the initial access vector is unknown;
• the company has not said whether this is ransomware or whether a ransom was demanded (The Record); when BleepingComputer asked about the encryption of devices and which systems were affected (corporate or in-store), a spokesperson pointed to the statement;
• the sources report no claims of responsibility, CVEs or indicators of compromise.

It is therefore not possible to describe the attack chain or map it to MITRE ATT&CK techniques without guessing.

The Register asked the company whether the incident is linked to the sabotage of refrigeration controllers at hundreds of French supermarkets that began on 11 October (we covered it in this article), without receiving an answer: no link has been established.

The 2024 precedent

This is the second major attack on the group in two years. In November 2024 an intrusion hit its US systems: according to The Register, some Stop & Shop stores had trouble filling prescriptions. The attack was claimed by the INC Ransom ransomware group and, according to the sources, compromised personal, financial and health data of more than 2.2 million people.

Impact for European and Italian companies

The case shows the cost of containment: proactively shutting down websites, apps and internal systems protects the infrastructure, but it halts e-commerce, deliveries and even employee services. The fact that stores stayed open shows that in-store operations could keep running without the digital channels that were switched off.

On the regulatory side, notifying the NCSC within 24 hours matches the early warning required by the NIS2 directive, followed by a notification within 72 hours and a final report within one month; in Italy (Legislative Decree 138/2024) the recipient is CSIRT Italia at ACN. NIS2 covers the wholesale distribution and industrial production of food: for large retailers with their own logistics, the classification must be checked case by case. If the investigation finds personal data involved, a GDPR notification to the data protection authority within 72 hours is also required.

What to do now

1. Prepare the decision to shut down: criteria, owners and a dependency map showing what stops (e-commerce, apps, customer service, staff portals) when you isolate a segment.
2. Separate channels: e-commerce, corporate systems, stores and countries with distinct networks, identities and administrative access, so you can isolate only what is needed.
3. Test store continuity: tills, payments and supply that keep working even when central systems are down.
4. Restore in phases and from clean systems: a priority order decided in advance, privileged credentials reset and backups verified before reconnecting each service.
5. Watch for typical intrusion signals: new admin accounts, out-of-hours logins, disabled protections, deleted backups, unusual outbound data transfers.
6. Keep notifications ready: templates for the CSIRT, the data protection authority and the police, plus messages for customers and employees, who may receive phishing in the company’s name after incidents like this.

How ARXDOME helps

ARX Sentry collects logs and events from computers, servers and firewalls and, in the SOC pages dedicated to identities, shows privileged logins, night-time logins and account changes. ARX Shield isolates a single suspicious machine from the network with one click, without shutting down entire services, and ARX Trace collects evidence from machines to reconstruct what happened. ARX Retain keeps logs on European storage with object lock, ready for investigations and reports to the authorities.

Last updated: 20 October 2026