Ahold Delhaize, the Dutch-Belgian owner of Food Lion, Stop & Shop, Giant Food and Hannaford, said Monday that the suspicious activity that forced it to take systems offline a week earlier was caused by "the malicious actions of others," confirming a cyberattack. Online shopping at Food Lion and Stop & Shop was still not working, The Record reported Monday. The week-long outage shows what containment can cost a major retailer even when, so far, no data theft has been found.
What Happened
In an update issued from its Zaandam, Netherlands, headquarters, the company said the investigation it began with outside cybersecurity experts had established that the activity detected in its IT systems came from an attack. Most of its brands in Europe and the U.S. were affected to varying degrees, it said, and websites and apps were taken offline, while all stores stayed open.
Recovery is uneven. The website and app of Albert Heijn, its Dutch supermarket chain, are back, with home deliveries expected to resume Friday, Oct. 23. E-commerce in Belgium is fully operational, and most sites and apps in Central and Southeastern Europe are available. For the U.S. brands, the company said only that e-commerce is expected to return in the coming days.
The company said it notified the Dutch National Cyber Security Centre within 24 hours of discovering the activity, has kept law enforcement and other regulators updated, and filed a formal report with Dutch police Monday. It said it has "no evidence at this moment" that sensitive customer, employee or partner data was taken, and that the investigation continues.
"Taking systems offline to help protect them was a precautionary measure," Chief Executive Frans Muller said in the statement, adding that the investigation so far confirmed it was the right decision.
Ahold Delhaize declined to describe the attack, telling The Record that more detail could compromise security measures or interfere with its response. It did not say whether a ransom was involved. The company did not respond to questions from The Register, and no claim of responsibility for the attack had been reported.
Why It Matters
The update moves the incident from a vaguely worded security issue, the company's description when it first disclosed it Oct. 12, to a confirmed attack. Filing a police report signals that the company now treats it as a crime.
For boards, the episode illustrates a tradeoff every large operator faces. Pulling systems offline can stop an intruder from spreading, but it also shuts revenue channels and customer services for days. Ahold Delhaize kept stores running, yet its U.S. online grocery business has been unavailable for about a week. Its finding of no evidence of data theft is explicitly provisional, since the investigation is still underway.
Context
This is the company's second major cyber incident in two years. A November 2024 attack on its U.S. systems disrupted operations at some brands, including prescription filling at some Stop & Shop pharmacies and Food Lion deliveries, according to The Register. Information on more than 2.2 million people was stolen in that incident, The Record reported. The ransomware group INC Ransom claimed responsibility for it and leaked some documents, The Register reported. No one has linked that group to the current incident.
What to Watch
The next markers are when e-commerce returns for Food Lion, Stop & Shop and the other U.S. brands, and whether Albert Heijn resumes home deliveries Oct. 23 as planned. Watch also whether the investigation later finds that data was taken, which could trigger breach notifications, and whether any group claims the attack.
