US and Europe retail sites offline after Ahold Delhaize confirms hackers forced systems down

Ahold Delhaize confirmed that malicious actors forced the company to take its IT systems offline, disrupting online services for grocery brands across the United States and Europe. The Dutch multinational retailer stated that this cyberattack impacted shoppers on both sides of the Atlantic, necessitating a precautionary shutdown of digital platforms to contain the breach and protect infrastructure from further compromise.

How it unfolded

• Last week, Ahold Delhaize announced it had detected suspicious activity within its IT systems, prompting an immediate internal security response.
• On Monday, the company confirmed that the activity was caused by malicious actors and filed a police report in the Netherlands regarding the incident.
• The retailer notified Dutch cybersecurity authorities within 24 hours of initially detecting the breach, as Circuit Observer reported on 2026-10-12 when network access was cut for 9,400 stores.

Who is affected

The incident disrupted online services in the United States, the Netherlands, and Belgium, although physical store locations remained open during the outage. In the US, online shopping services for brands including Food Lion and Stop & Shop are not yet functional. Customers using these platforms have been unable to place orders or access digital account features while the company works to restore secure operations and verify system integrity.

In Europe, the websites and apps for Dutch brands Albert Heijn, Etos, and Gall & Gall are back online. However, Albert Heijn home deliveries are not expected to resume until Friday. E-commerce services in Belgium and Central and Southeastern Europe have already been restored. Chief Executive Officer Frans Muller apologized for the disruption, stating that taking systems offline was a necessary precaution to ensure safety.

What happens next

Ahold Delhaize said it is restoring services in phases and expects US online shopping services to resume in the coming days. The company cautioned that the investigation into the hack remains ongoing and stated it has no evidence that sensitive customer, employee, or partner data was stolen. The retailer declined to share further details about the nature of the attack or whether a ransom was involved, citing the need to avoid compromising security measures or interfering with response efforts.

The background in plain language

When organizations detect unauthorized access, they often disconnect their networks from the internet to stop attackers from moving deeper into the system. This process, known as isolation, prevents further data theft or damage but temporarily halts digital services. Teams usually verify that the threat is contained before reconnecting services. This approach prioritizes security over immediate availability, ensuring that any malicious code or access paths are removed before normal operations resume for customers and employees.

Background: Unauthorized access

Yes, they are different. Unauthorized access means entering a system without permission. Unauthorized use means entering with permission but acting beyond allowed boundaries. Access violations trigger perimeter alerts. Use violations require behavioral analysis to detect, as the actor already possesses valid credentials and expected network presence.

Read the full guide: Difference Between Unauthorized Access and Unauthorized Use Explained

What to do and how to stay safe: Ahold Delhaize

• Monitor official communications from affected retailers for updates on service restoration timelines and potential changes to order processing.
• Review recent account activity for any unauthorized transactions or changes to shipping addresses, especially if you ordered during the outage window.
• Enable multi-factor authentication on retail accounts to add an extra layer of security against credential theft, even if no data breach is confirmed.
• Keep contact information up to date in retailer profiles to ensure you receive direct notifications about order status changes or delivery delays.

Step-by-step guide: Mobile Device Security for Small Business: Control Without Cost

General security guidance from the Circuit Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Did Ahold Delhaize confirm that customer data was stolen in this attack?

The company stated it has no evidence that sensitive customer, employee, or partner data was stolen, though the investigation remains ongoing.

Are physical grocery stores still open during the cyberattack?

Yes, Ahold Delhaize confirmed that while online services were disrupted, physical store locations remained open during the incident.

Will Albert Heijn home deliveries resume immediately?

No, Albert Heijn home deliveries are not expected to resume until Friday, even though the website and app are back online.