Ahold Delhaize Shut Down Albert Heijn and Five US Chains and Still Will Not Say What Happened

77 million shoppers a week. On a Sunday afternoon, the company behind them switched off its own systems. Shelf labels showed last week’s prices. Six days later, it still has not said what happened.

I wrote about this in my newsletter on Friday. This morning, Saturday, the Albert Heijn website still shows an error page. I assume it was an attack. A company that big does not shut everything down for nothing. That is my opinion.

The company is Ahold Delhaize, based in Zaandam in the Netherlands. It owns Albert Heijn in the Netherlands, Delhaize in Belgium, and five chains in the United States. Its own website gives the size: 77 million customers a week, 9,551 stores and 384,000 employees.

On Sunday afternoon, October 11, Albert Heijn and its sister chains Etos and Gall & Gall switched off part of their own computer systems. The company said it did this to protect its IT systems. By Monday morning the website, the app and customer service were offline, and online orders could not be delivered. The personal discounts on the Bonus card stopped working, and so did the savings stamps and Air Miles. The stores stayed open and the tills kept working.

Albert Heijn stores use electronic shelf labels, small screens on the shelf that get their price from a central system. With that system off, the labels kept showing the offers of the week before. At the till, shoppers paid the current price, which was often higher. One store in Amsterdam put up a note to explain it. The labels showed the right prices again on Tuesday, October 13.

The stores get their goods from distribution centres, and those stopped too. At the distribution centre in Tilburg, the workers were sent home around noon on Tuesday. A driver told the regional broadcaster Omroep Brabant: “Nothing works. The systems are down.” Without those systems the staff could not pick the orders for the stores. All Albert Heijn stores in Belgium get their goods from that same centre, the Belgian broadcaster VRT reported, although the chain said the impact in Belgium stayed limited. In the Netherlands, shelves emptied, mostly dairy, vegetables and fruit.

In Belgium, Delhaize customers could not place new online orders, and customer service could not be reached. In the United States, the websites and apps of Food Lion, Stop & Shop, Hannaford, Giant Food and The Giant Company went offline on Monday, October 12. On Wednesday they were still down, and on Friday it was the fifth day in a row. American shoppers were sent to Instacart, DoorDash and Uber Eats instead. A spokesperson for that last chain told the Philadelphia Inquirer that if its app was still down on Friday, it planned to switch on all digital coupons on its customers’ loyalty cards automatically.

Employees felt it too. According to posts from staff on Reddit, quoted by BankInfoSecurity, Stop & Shop workers could not see their schedules or pay stubs in Kronos, their time-tracking system. Food Lion workers lost access to Spectrum, the company’s own platform for picking and handing out online orders. Food Lion staff were told to call it an “IT outage”.

On Monday morning, Ahold Delhaize put out a short press release. It was experiencing “a security issue within its network” and was “taking some systems offline to help protect them”. The same release carried a line meant for investors. It said the release contained news that can move the share price, what EU market rules call inside information. The public got “a security issue”.

On Tuesday, the company said it had “no evidence at this moment” that data of customers, employees or partners was taken, and that it had started to switch some systems back on in a controlled way. In an update on Wednesday, it added that it was working with its own teams, outside cybersecurity experts and the relevant authorities. It would not say more, because that could weaken its security or the way it responds.

In six days, the company has not called it an attack or a hack. Albert Heijn first spoke of an IT incident, and later of a cybersecurity incident.

On Tuesday, the public broadcaster NOS spoke to anonymous people in the security sector. According to them, the security staff at Albert Heijn saw suspicious attack traffic coming in, and switched the systems off while it was arriving. That, they said, stopped the attackers from getting deeper into the network. The traffic came through servers in the United States, Poland, Moldova and Turkey. Servers of Ahold’s own American branch may have been used as well, but that is not confirmed. Albert Heijn did confirm one thing: it shared details about the servers the attackers used with other companies.

Attackers rent servers in whatever country they like, or break into someone else’s server and send their traffic through it. A server in Poland shows the route the traffic took, and nothing about where the attackers are. The broadcaster made the same point. In cybersecurity, attribution, working out who is behind an attack, is one of the hardest problems.

Pim Takkenberg is a security specialist and a former police officer. On the current affairs programme Nieuwsuur he said: “It seems pretty clear to me that someone with bad intentions has been inside the system.” He thinks of criminals who are after money. He also told the broadcaster that the attackers may have broken into the American servers first, and attacked the Dutch systems from there.

On Friday, November 8, 2024, the American branch of Ahold Delhaize announced that it had detected a cybersecurity issue in its US network. It took some systems offline “to help protect them”. Hannaford stopped pickup and delivery orders for several days. The company said it had brought in outside cybersecurity experts and notified law enforcement.

Five months later, on April 16, 2025, the ransomware group INC Ransom put Ahold Delhaize on its leak site, a website where criminals publish what they stole from companies that do not pay. The group claimed up to 6 terabytes of stolen data. One day later, the company confirmed that files from its American systems had been stolen.

In June 2025, a notice filed with the US state of Maine put the number of people at more than 2.2 million. They were current and former staff and their family members. Depending on the person, the files held names, contact details and dates of birth, Social Security, passport and driver’s license numbers, bank account numbers and health information. In July 2025, one of them filed a class action against the company, a lawsuit on behalf of a large group of affected people, in a federal court in North Carolina.

The stolen files were not only about Americans. In April 2025, Ahold Delhaize said it suspected that data of staff in the Netherlands had been taken as well. It concerned people on the payroll in April 2021 at Albert Heijn, Etos, Gall & Gall and other parts of the group. According to the newspaper AD, that meant names, bank account numbers and the amount of their salary payment of early April 2021. Ahold reported it to the Dutch Data Protection Authority. This week, the anonymous sources pointed to servers of that same American branch.

Same company, same words, almost two years apart. Last time, the full picture came out five months later, after the criminals had put it on their own leak site.

A company can have reasons to say little while an investigation runs. A public statement can come back later in a lawsuit, or in the claim with an insurer, and since 2025 Ahold knows the first one from experience. Whether that is the reason now, the company has not said.

The Dutch police and the Public Prosecution Service did something unusual on Wednesday, October 14. They publicly invited Ahold to file a police report. Police rarely do that in public, the broadcaster noted.

Ahold did report the incident to the National Cyber Security Centre, as a new Dutch cyber law that took effect in August requires. That notice is not the same as a report to the police.

The police and prosecutors can also start an investigation on their own, without a report. They have not. Stan Duijf, who leads the police approach to cybercrime, explained why on the talk show Pauw & De Wit on Thursday. Albert Heijn says no sensitive customer data was lost, and he called that an important reason not to start one yet. He also said: “We say: do it as early as possible, because then we can actively start the investigation.”

The police call the first hours after an attack the golden hour. The longer it takes before investigators can start, the more traces disappear. With an investigation, the police can seize servers or search them to see what runs on an IP address.

In 2024, the American branch notified law enforcement from the start. This time, in the Netherlands, the police are relying on the company’s own word.

By Thursday evening, the company had still not filed a police report. On Friday, justice minister David van Weel said he understood that a company first focuses on protecting its systems, but that the time had come to file a report. He was also in contact with Frans Muller, the CEO of Ahold Delhaize, and pressed him for openness. A spokesperson said they could not respond to the minister’s words, Reuters reported.

Three estimates of the damage are going around, and they are far apart.

Cor Molenaar, emeritus professor of e-marketing at Erasmus University Rotterdam, put the damage for Albert Heijn at about 10 million euros, and warned it could grow fast the longer it lasts. He also thinks it was a DDoS attack, where many computers flood a system with traffic until it stops working. The other experts I found think someone got inside.

Retail expert Erik Hemmes calculated that Albert Heijn had missed about 21 million euros in revenue in its stores and online by Wednesday.

The financial paper Het Financieele Dagblad heard from people in the supermarket sector, who did not want to be named, that the crisis costs Ahold Delhaize tens of millions of euros a day. Ahold told that paper it was too early to say what the financial impact would be.

For scale: in the last three months of 2025, Ahold Delhaize sold for 23.5 billion euros. That is more than 250 million euros a day, for all of Ahold Delhaize together. Most of it comes through the tills in the stores, and those stayed open. Shoppers who could not order from Albert Heijn went elsewhere. Jumbo, Lidl, Picnic, ALDI and PLUS all told the news agency ANP that their stores were busier and they got more online orders.

On the stock market, the share fell almost 3 percent on Monday, the biggest loser in the Amsterdam AEX index that day, and then recovered. It closed at 32.36 euros on Friday. On November 4, Ahold Delhaize publishes its results for the third quarter, its first scheduled results since the incident started.

That same Sunday night, a few hours after the systems at Albert Heijn went off, attackers heated the fridges and freezers in hundreds of French supermarkets to 50°C. I wrote about that on Tuesday. Two incidents at supermarket groups in one weekend, and yet Ahold Delhaize and the NCSC both said they see no sign that the two are connected.

An intrusion into a company network usually starts at one weak point: a stolen password, or a server facing the internet that missed an update. The password often comes from a phishing email that tricks an employee into typing it on a fake page. From that first machine, the attacker looks around, to see which other machines are on the network and where the passwords are kept. The attacker collects those passwords and moves from machine to machine, until reaching the systems that run the business or hold the data.

In a ransomware attack, the data gets copied out first. Then the attacker encrypts the files on the machines, so the company cannot open them. The company now has two reasons to pay: to get its systems back, and to keep its data off a leak site.

This is why security staff pull systems off the network the moment they see attack traffic. An attacker sitting on one machine needs the network to reach the next one. Cut the connections, and the attacker is stuck. The company is stuck too. At Albert Heijn the tills kept working, but the distribution centres, the app and the deliveries did not. Days of empty shelves and more than a week of cancelled orders are the price of not letting someone go further. The company says it has no evidence so far that anything was taken.

As of Friday evening, Albert Heijn had cancelled all online orders up to and including Tuesday, October 20, and new orders still could not be placed. Customers who already paid will be compensated once the systems work again. Deliveries should start again in the second half of next week. Customer service is still unreachable. The shelves are full again.

On November 4 the company talks to its investors. Until then, a leak site may say more than Ahold Delhaize does.

Want to see what an attacker does after the first machine, from collecting passwords to moving through a network? Build it in your own lab. My Ethical Hacking Complete Course Zero to Expert takes you there step by step: reconnaissance, scanning, exploitation and traffic analysis, hands-on, from your first day with no Linux or hacking background.

→ Join my complete ethical hacking course

Hacking is not a hobby but a way of life.

Sources:

Ahold Delhaize press release, October 12, 2026 | Ahold Delhaize update on the cybersecurity incident | Albert Heijn media statement | Ahold Delhaize statement on the November 2024 incident | Ahold Delhaize key figures