22OCT

Ahold Delhaize confirms attack on brands

2 min read

16:31UTC

Ahold Delhaize's chief executive said on 19 October that the previous week's outages at its grocery brands "was caused by the malicious actions of others". Stores stayed open, but US online shopping had not returned.

← Back to Fridge hack spoils food in seven countries Jump to analysis ↓

TechnologyAssessed

Key takeaway

Ahold Delhaize says deliberate attacks took down most of its banners' systems, without data theft found so far.

Ahold Delhaize, the Dutch-Belgian grocer, confirmed on 19 October that outages across its brands the previous week were deliberate. Chief executive Frans Muller said the disruption "was caused by the malicious actions of others"⁠¹. Systems went offline across most of its US and European banners, among them Food Lion and Stop & Shop in the US and Albert Heijn, Etos and Gall & Gall in the Netherlands.

Stores stayed open. US online shopping had not returned by 19 October, and Albert Heijn expects home deliveries back by Friday 23 October. The company says it has found no evidence that customer, employee or partner data was taken, and it filed a Dutch police report.

On the company's account so far, the damage sits in the systems that take and fulfil orders rather than in stolen data. Boston Scientific's August outage hit the same layer, disrupting worldwide order processing and shipping.

Deep Analysis

In plain English

Ahold Delhaize owns many supermarket chains, including Albert Heijn in the Netherlands and Food Lion and Stop & Shop in the US. Last week many of its computer systems went down, and the company has now confirmed that criminals caused it. The shops stayed open, but online ordering and home delivery stopped. The company says it has found no sign that customer data was stolen, and it has reported the attack to Dutch police.

Deep Analysis

Root Causes

An outage that reached Food Lion in the US and Albert Heijn in the Netherlands in the same week suggests banners on both continents share group-level platforms for e-commerce or fulfilment. Sharing cuts cost but lets one intrusion cross an ocean.

Grocery e-commerce also depends on a tight chain of systems: ordering, picking, slot booking and delivery routing. Restoring one without the others delivers nothing to the customer, which is why stores traded through while home delivery took far longer to return.

What could happen next?

Consequence
US online shopping at Ahold Delhaize banners had no stated return date on 19 October, extending lost online sales.
Risk
If a later investigation finds data was taken, the company's no-evidence statement will need revising in both US and Dutch jurisdictions.

Source Landscape

This story draws on neutral-leaning sources

Primary parallel: ASOS's 6 October incident hit another European retailer the same month. In both, the shop floor kept trading while digital channels took the damage.

Counter-parallel: Boston Scientific's August outage also left most physical operations running, yet the company warned it was unlikely to meet its guidance. Ahold Delhaize has issued no such warning so far.

With stores open, the direct revenue loss falls on online orders in the US and the Netherlands, plus incident response and recovery costs. Albert Heijn's 23 October delivery target sets the length of the Dutch outage.

The longer-term risk lies in online grocery churn: shoppers who switch delivery provider during an outage may not come back.

Consensus view: Chief executive Frans Muller's wording confirms intent without naming a method, a ransom or an attacker. Ahold Delhaize's statement that it found no sign of data theft, while US online shopping stays down, describes an attack on availability rather than on records.

Counter-view: The Record reports that systems were taken offline across most US and European brands, which suggests the company pulled them itself to contain the intrusion. On that reading, part of the outage reflects the defence rather than the damage, and Ahold Delhaize has not called the incident ransomware.

Key tension: Whether e-commerce stays down because attackers broke it, or because the company will not reconnect until it is sure the intruder has gone.

Sources:The Record

Mentions:Netherlands →United States →ASOS →Boston Scientific →Boston →Ahold Delhaize →Frans Muller →Food Lion →Stop & Shop →Albert Heijn →Etos →Gall & Gall →

First Reported In

Update #15 · Fridge hack spoils food in seven countries

The Record· 22 Oct 2026

Read original →

Different Perspectives

Hospital Sírio-Libanês

Hospital Sírio-Libanês said a 21 September attack reached a reporting system for its social projects, possibly exposing patients' and staff identity numbers and health information, while its general patient database was untouched. It notified the ANPD and the Polícia Federal and warned of fraud attempts.

The Foschini Group

The Foschini Group told the Johannesburg exchange on 13 October that an attack found on 11 October disrupted IT systems at its TFG London brands, while stores stayed open. It has not identified the attackers or established whether personal data was taken.

FirstVDS

FirstVDS said attackers used a VMmanager 6 flaw to copy customers' passwords, cloud credentials and cryptocurrency wallets from beneath their virtual servers, and told notified customers to assume theft and rotate credentials. ISPsystem's flaw was not fully fixed on 19 October.

ESET

ESET says Russia-aligned UAC-0099 phished a Ukrainian grain logistics firm in July 2025 and apparently passed its access to GRU-linked Sandworm, which wiped the company's data that September. It treats the attackers' use of the Yggdrasil network as a first for a state-aligned actor.

JPCERT/CC

JPCERT/CC issued emergency alert AT-2026-0032 on 14 October as EG Secure Solutions confirmed attacks on the SiteGuard Server Edition flaw. It told operators to save diagnostic data before updating, because the update may erase traces of the attack.

Cyber Security Agency of Singapore

The Cyber Security Agency of Singapore said on 20 October that attackers are exploiting Ivanti Connect Secure, seven days after Ivanti's disclosure, having flagged PAN-OS exploitation on 16 October. It issued a PHP2Shell alert on 21 October, the day the fixes shipped.

Written with AI from Lowdown's published reporting. Not individually reviewed by an editor. Editorial standards.