Ahold Delhaize, the Dutch-Belgian grocery group behind Food Lion, Stop & Shop, Giant Food and Hannaford in the U.S. and Albert Heijn in the Netherlands, said Tuesday it has begun a controlled restart of some systems after a security issue in its network forced it to take them offline. The precautionary shutdown disrupted online ordering, deliveries and in-store pricing on both sides of the Atlantic, The Record reported Tuesday, showing how isolating a network to contain an intruder can itself interrupt a retailer's daily operations.

What Happened

In a statement issued early Monday from its Zaandam, Netherlands, headquarters, the company said it was experiencing a security issue within its network, that its teams were assessing and mitigating it, and that some systems had been taken offline to protect them. Stores remained open. The company flagged the notice as inside information under the European Union's Market Abuse Regulation, the label listed companies use for news that could move their share price.

An update Tuesday said teams were restoring affected systems, that stores in Europe and the U.S. were open but the impact varied by brand, and that the company was working with external cybersecurity experts and was in contact with the relevant authorities. It said it had "no evidence at this moment that customer and associate data was taken" and that the investigation continues. Neither statement says what kind of incident it is.

RelatedCybersecurity Incident at BAE Systems Halts Notices From U.S. Bankruptcy Courts

In the U.S., the websites of all five Ahold Delhaize USA chains, Hannaford, Stop & Shop, Giant Food, Food Lion and The Giant Company, were down Monday morning, Cybersecurity Dive reported. The U.S. unit told Grocery Dive it had no timeline for bringing systems back. BleepingComputer reported that Stop & Shop employees said on Reddit they could not reach work schedules or pay stubs, and that an internal Food Lion memo shared by employees called the problem an IT outage and warned stores might be unable to shop, stage or hand off orders. SecurityWeek noted that reports of U.S. store impact rest on such posts rather than company statements.

In the Netherlands, Albert Heijn, Etos and Gall & Gall were affected from Sunday afternoon, according to Dutch broadcaster NOS as cited by The Record. Albert Heijn's website, app and customer service went down, deliveries were suspended, and electronic shelf labels showed outdated promotional prices. In Belgium, Delhaize customers could not place new orders or reach customer service, Belgian broadcaster VRT reported.

Why It Matters

Ahold Delhaize runs more than 9,400 stores in Europe, the U.S. and Indonesia and serves about 60 million customers a week, BleepingComputer reported. Online orders alone account for about 10% of Albert Heijn's sales, Reuters reported. The episode shows that ordering, delivery scheduling, shelf pricing and staff payroll access all depend on the same central network, so a decision to cut systems off for safety lands on customers and employees in several countries at once.

For boards, the incident is a test of disclosure as much as defense. The company told markets within hours, but questions BleepingComputer sent about whether devices were encrypted, a hallmark of ransomware, were answered only with a reference back to the public statement.

Context

This is the company's second major incident in under two years. A November 2024 attack disrupted Giant Food pharmacies and Hannaford, Food Lion, The Giant Company and Stop & Shop, SecurityWeek reported. The INC Ransom group claimed it in April 2025, and in June 2025 Ahold Delhaize told U.S. regulators that personal information of more than 2.2 million people had been compromised.

The disruption began the same weekend a cyberattack on refrigeration systems forced French supermarkets to discard chilled food. Dutch authorities said they saw no connection between the two, Reuters reported.

What to Watch

No group has publicly claimed the incident, SecurityWeek reported. Key signals are whether the company identifies the type of attack, whether its finding on customer and employee data changes as the investigation continues, which could bring notification duties, and how quickly online ordering and the U.S. chain websites return.