Summary

• Ahold Delhaize confirmed on 19 October that malicious activity caused the incident first disclosed on 12 October, and filed a formal report with Dutch police.
• Albert Heijn's website and app are operating again, with home deliveries expected to resume from 23 October; Belgian e-commerce has fully recovered.
• Physical shops remained open, but digital services and distribution were disrupted across several brands. Investigators have not established evidence that sensitive customer, employee, or partner data was taken.

Ahold Delhaize has confirmed that malicious activity caused the cybersecurity incident affecting its retail operations across Europe and the United States, as the supermarket group continues restoring digital services following more than a week of disruption.

The company filed a formal report with Dutch police on 19 October, having previously notified the country’s National Cyber Security Centre within 24 hours of detecting suspicious activity. Its investigation has established that the incident resulted from the actions of external parties, although the identity of those responsible and the method used to compromise the systems have not been disclosed.

Ahold Delhaize took several systems offline as a precaution, affecting websites, applications, and associated services across many of its retail brands. Physical stores remained open, but online ordering and parts of the distribution process were interrupted.

The group says it has found no evidence so far that sensitive customer, employee, or partner information was taken. That remains an interim finding while forensic work continues, rather than a definitive conclusion about every aspect of the incident.

Digital restoration follows different timetables

Albert Heijn, the group’s largest Dutch supermarket chain, has restored its website and customer application, allowing shoppers to regain access to much of their personal account functionality.

Home deliveries have taken longer to resume, with the retailer expecting services to restart from Friday 23 October. Customers could therefore regain access to the digital storefront before the fulfilment operations required to complete online orders were fully available.

That distinction reflects the way modern retail services depend on several connected systems. A shopping application can operate while order processing, warehouse systems, payment arrangements, or delivery scheduling remain subject to restoration work.

Ahold Delhaize has also restored the websites of Dutch pharmacy and health retailer Etos and drinks retailer Gall & Gall. Across its Central and Southeastern European businesses, the company reports that customer websites and applications are available again.

In Belgium, e-commerce services have returned to full operation, while the American retail brands are expected to restore online shopping during the coming days. The group has not provided a single confirmed date for completing every part of the recovery.

Its US businesses include Stop & Shop, Giant Food, Hannaford, and Food Lion, whose online services have experienced disruption despite their physical stores remaining operational.

The recovery has also involved distribution operations. Albert Heijn restored regular deliveries to stores during the preceding week, following disruption that affected stock availability in parts of its network.

Those improvements do not imply that every affected internal system has returned to its pre-incident condition. Ahold Delhaize says it is restoring services in phases while continuing its investigation and maintaining precautionary controls.

Keeping shops open did not preserve every service

Retailers rely on technology for activities extending well beyond customer-facing websites. Ordering, inventory management, warehouse operations, supplier coordination, employee systems, and online fulfilment can depend on shared applications or infrastructure.

A disruption affecting those connections may produce different consequences across individual brands, even when their physical premises remain open.

The incident illustrates how the ability to trade from stores can coexist with interruptions to services that customers and employees depend on. Shoppers may still purchase groceries in person while digital ordering becomes unavailable, loyalty functions are interrupted, or deliveries are delayed.

Distribution introduces another layer of dependency. When systems coordinating stock movements are unavailable, retailers may need temporary procedures to continue replenishing stores. Those arrangements can help preserve operations but may offer less flexibility or visibility than the systems ordinarily used.

Products with limited shelf lives make interruptions particularly difficult to manage, although Ahold Delhaize has not disclosed detailed figures for spoiled stock or the financial effect of distribution disruption associated with this incident.

Temporary service limitations may also affect customer behaviour. Online shoppers who cannot complete orders may turn to competing retailers, while those with recurring deliveries or time-sensitive requirements must make alternative arrangements.

The company has not published a comprehensive financial estimate of the incident. It would therefore be premature to assign a confirmed loss figure or assume that every missed online order represents permanently lost revenue.

Controlled recovery requires trusted infrastructure

Taking systems offline can restrict opportunities for attackers to continue operating, but the decision also creates disruption that must be managed across the business.

Before restoring affected services, investigators need to understand the scope of the intrusion, examine whether unauthorised access remains possible, and establish which systems can be reconnected safely.

For a retailer with operations across several countries, the process may involve applications shared by multiple brands alongside systems managed within individual national businesses.

Restoration decisions can therefore be different for each operation. One service may be ready to return while another remains dependent on technical checks or supporting systems that have yet to be restored.

Ahold Delhaize has engaged external cybersecurity specialists and is working with the relevant authorities. The company says it will not disclose further technical details while doing so could compromise its security measures or the investigation.

The available information does not establish that the incident was ransomware, that customer data was stolen, or that the same attackers were responsible for unrelated cyber incidents affecting other European retailers.

Those distinctions remain important because cyber incidents occurring at a similar time are not necessarily connected. Establishing a common cause requires technical evidence rather than similarities in business sector or operational disruption.

Operational resilience extends beyond preventing theft

The incident demonstrates the importance of treating service availability as a separate concern from the confidentiality of customer information.

An organisation may experience significant commercial disruption without investigators finding evidence that sensitive records have been removed. In such circumstances, restoring the ability to provide services can become a central business priority alongside determining how the intrusion occurred.

Technical continuity arrangements need to reflect those dependencies. Backups and incident response procedures can support recovery, but their effectiveness depends on whether the business can restore trustworthy applications, reconnect systems safely, and maintain essential operations during the interruption.

For retail groups operating multiple brands, decisions about common technology platforms also influence the potential scale of disruption. Shared systems can reduce operating costs and simplify administration, while creating dependencies that need to be understood when planning containment and recovery.

Ahold Delhaize’s phased restoration offers a practical illustration of those trade-offs. The company maintained its stores while taking parts of its digital infrastructure offline, then returned different services as technical and operational conditions allowed.

Its latest announcement confirms malicious activity and the filing of a police report, but leaves several technical and financial questions unanswered. Those include the means of entry, the full scope of affected systems, and the eventual cost of the disruption.

With Belgian e-commerce restored and Albert Heijn deliveries expected to resume from 23 October, attention now turns to the remaining services and the results of the investigation. A complete assessment will depend on the restoration of normal operations and any further findings disclosed by the company or investigating authorities.