What the company has said
Ahold Delhaize said on October 12, 2026 that it is experiencing a security issue within its network. Its teams are assessing and mitigating the issue, which includes taking some systems offline to help protect them. The company said its stores are open and serving customers.
The press release says nothing about:
- who is responsible
- whether ransomware or data theft is involved
- which systems are affected
- when services will return
The wording is worth noting. Sqmagazine observed that the release's headline says "cybersecurity incident" while the body text says "security issue." It also noted that Albert Heijn called it an "IT incident," and that none of the labels in circulation says an attacker was involved. Headlines that say "cyberattack" are ahead of what the company has actually confirmed.
What Dutch customers are seeing
Albert Heijn, Etos and Gall & Gall published their own media statement, which is more concrete than the parent's. It says the three brands have been dealing with a cybersecurity incident since Sunday afternoon, October 11, and that systems were disabled preventively. According to that statement:
- Customer-facing services: websites, apps and customer service are temporarily unavailable.
- Logistics: logistics systems were also shut down, so online grocery orders cannot be delivered until further notice.
- In stores: shops remain open, and checkout systems and this week's national Bonus offers work.
- Shelf labels: electronic shelf labels still show last week's promotional prices. A label for an expired promotion may therefore show a lower price than the register charges.
- Loyalty: the savings systems tied to the Mijn AH app and personal Bonus card are not working. That includes Mijn Bonus Box, Koopzegels, Air Miles and other savings promotions.
- Compensation: customers who miss personal discounts will be compensated when possible and should keep their receipts.
- Timeline: the company said it cannot yet say when services will return, and that protecting customer, employee and partner data comes first.
"Stores open" therefore does not mean everything works. Checkout is reported to be functioning in the Netherlands, but online ordering, delivery, support and loyalty are not. Cybernews and ITdaily report the same pattern. ITdaily says Delhaize in Belgium is also reporting IT problems.
Reports from elsewhere
BleepingComputer reports that employees at Stop & Shop in the US are having trouble accessing their schedules and pay stubs. It also cites an internal Food Lion memo that describes an IT outage and warns that stores may be unable to "shop, stage, or hand off orders." These come from employee-shared material and the outlet's own reporting, not from the parent company's statement. Ahold Delhaize had not answered BleepingComputer's questions about whether corporate and store systems were both affected, whether the disruption is worldwide, or whether any devices were encrypted.
It would be wrong to assume every subsidiary or country is affected equally. The confirmed picture is:
- a brief parent statement with no scope
- a detailed statement from three Dutch brands
- employee and press reports from Belgium and the US
One regional detail points the other way. Informat.ro reports that Mega Image and Profi are operating normally in Romania. Hart van Nederland says bol.com, which is part of the group, appeared to be working for now. That is a media observation, not a company confirmation.
How this differs from the 2024 breach
This is not the first time. In November 2024, Ahold Delhaize USA disclosed a cybersecurity issue in its US network. It was investigating with outside experts, had notified law enforcement and had taken some systems offline. Some pharmacies and e-commerce operations were affected, and stores stayed open. In April 2025, the company said its investigation indicated that certain files had been taken from internal US business systems.
A US state data-breach notice filed with the Massachusetts government describes unauthorized access to internal US business systems that was detected on November 6, 2024. It said personal information in employment records may have been affected. BleepingComputer attributes that 2024 attack to the INC Ransom group and puts the number of people affected at over 2.2 million.
No source reviewed connects the 2024 incident to the current one. Treat the two as separate unless Ahold Delhaize or investigators say otherwise. The similar wording ("taking some systems offline to help protect them") reflects a standard incident-response playbook, not evidence of the same attacker.
Why IT teams should pay attention
This is general analysis, not company-confirmed detail. The pattern is familiar to anyone who runs enterprise infrastructure.
- Precautionary shutdowns hit the periphery first. Web, app, loyalty and logistics layers go dark while core checkout survives. Retailers that separate in-store point of sale from e-commerce and logistics can keep trading while they investigate.
- Back-office systems matter. Schedules and pay stubs are exactly what staff need during a disruption. Business continuity plans should cover HR and workforce tools, not just customer-facing systems.
- Stale data causes its own problems. Shelf labels that show old promotional prices create a pricing mismatch between shelf and register that customers will notice.
- Communication discipline matters. The company's wording avoids unconfirmed claims, which is the right approach until the facts are known. The release also states it contains inside information under Article 7(1) of the EU Market Abuse Regulation, a reminder that incidents at listed companies have disclosure obligations.
What is still unknown
- the cause and entry point
- whether ransomware, encryption or data exfiltration is involved
- whether customer or employee data is affected
- the full geographic scope
- when systems will be restored
Ahold Delhaize and its brands have promised updates as the picture becomes clearer. Until then, customers should keep receipts if they were affected by missed discounts. They should also treat unsolicited messages about the outage with caution. That caution is general advice, not a warning from the company.