The Dutch-headquartered supermarket operator Ahold Delhaize disclosed on Monday that hostile actors orchestrated a cyberattack that compelled it to shut down systems serving its portfolio of retail chains on both sides of the Atlantic. The company acknowledged that the suspicious activity detected in its infrastructure the previous week stemmed from deliberate malicious conduct, and said it lodged a complaint with law enforcement authorities in the Netherlands the same day.
The assault disrupted digital shopping capabilities across the US, Netherlands and Belgium, though physical locations continued operating normally. While Ahold Delhaize stated it had found no indication that confidential information belonging to customers, staff or business partners had been compromised, the company noted that its investigation was still underway. The retailer declined to elaborate on specifics of the assault or whether extortion demands were made, explaining: "We are not sharing further details that could compromise security measures or interfere with our response efforts."
The company indicated it was bringing services back online incrementally. In the United States, e-commerce operations at chains including Food Lion and Stop & Shop remained unavailable, though the company anticipated restoration within days. The digital platforms for Albert Heijn, Etos and Gall & Gall in the Netherlands had resumed functioning, but Albert Heijn's home delivery service was not expected to be fully operational until Friday. The company confirmed that e-commerce had already been restored in Belgium and Central and Southeastern European markets.
Chief Executive Officer Frans Muller issued an apology for the service interruptions, characterizing the decision to take systems offline as a prudent defensive action. "Although this incident was caused by the malicious actions of others, we apologize for the inconvenience this has caused — especially to our customers," Muller stated. The company also noted that it had alerted Dutch cybersecurity authorities within 24 hours of first identifying the breach.
This marks the second major cyberattack affecting Ahold Delhaize in recent years. A previous incident in 2024 compromised systems at major supermarket operations across the United States, resulting in the theft of personal information from more than 2.2 million individuals.
