Ahold Delhaize, the parent company of Stop & Shop, said in an update dated Oct. 19 that online shopping for its U.S. brands is expected to return in the coming days, a week after the grocery group first disclosed a cybersecurity incident on Monday, Oct. 12. Stores stayed open throughout. The company has said it found no evidence so far that sensitive customer, associate or partner data was taken.
The day in tech, in one email: TLDR is the daily newsletter with links and TLDRs of the most interesting stories in startups, tech and programming.
We may earn a commission if you sign up.
What went dark and what came back
After detecting suspicious activity in its IT infrastructure, Ahold Delhaize brought in cybersecurity experts, confirmed the activity came from malicious actors, and proactively shut down certain systems, including brand websites and apps. The shutdown affected most brands in Europe and the United States, though the impact varied by brand.
The company’s Oct. 19 status update lists the recovery brand by brand. Albert Heijn’s website and app are back online, with home deliveries expected to resume on Friday, Oct. 23. The Etos and Gall & Gall websites are available again, e-commerce in Belgium is fully operational, and most websites and apps in Central and Southeastern Europe have returned. For Ahold Delhaize USA, the update says only that e-commerce is expected to return in the coming days, so the American brands were the last major group still waiting. The update does not name which U.S. banners are covered by the e-commerce shutdown, and the company gave no date beyond the coming days.
The company’s first two notices set the timeline. Its Oct. 12 statement announced precautionary measures after the incident, and an Oct. 13 update followed a day later. Frans Muller, president and chief executive, said in the Oct. 19 update: “The investigation to date confirms this was the right decision.” The decision he refers to is the proactive shutdown of systems, which kept the stores themselves open while the brands’ websites and apps went offline in Europe and the United States.
Stop & Shop staff and the U.S. brands
BleepingComputer, in a report by Sergiu Gatlan on Oct. 20, described the disruption before the company’s latest update. Customers in the Netherlands could not use websites, apps or customer service platforms at Albert Heijn, Etos and Gall & Gall, and Delhaize customers in Belgium had the same problems. In the United States, Stop & Shop employees reported trouble accessing their schedules and pay stubs, according to a Reddit post the outlet cited but did not independently verify.
BleepingComputer asked whether corporate and store systems were both affected and whether any devices were encrypted. A spokesperson pointed it to the company’s statement, so those questions are unanswered. Muller apologized for the inconvenience, especially to customers. The outlet also pointed to Dutch broadcaster NOS, which covered missing deliveries and wrong shop prices after the incident at Albert Heijn, and the outlet notes that Albert Heijn’s home deliveries are not expected back until Friday, Oct. 23.
Ahold Delhaize is large enough that a multi-brand outage reaches a lot of shoppers. BleepingComputer’s report says the attack took place the prior week but gives no exact date, and the company’s own first disclosure is the earliest dated record, on Monday, Oct. 12. BleepingComputer cites the company’s own scale as more than 384,000 employees, 9,551 stores and about 77 million customers each week across the United States, Europe and Indonesia. No ransomware group had claimed the 2026 incident in that report, and the company has withheld technical details that it said could compromise its response or security measures.
Regulators, police and an earlier breach
Ahold Delhaize said it notified the Dutch National Cyber Security Centre within 24 hours of discovering the activity and has kept the center, law enforcement and regulators updated. On Oct. 19 it filed a formal police report with Dutch police. The investigation is ongoing, and the statement that no sensitive data has been found to be taken is explicitly limited to what the inquiry has found so far, and the company has not said how the intruders got in or how long they were inside its network.
The group has been here before. In November 2024 a breach of its U.S. systems was claimed by the INC Ransom group. BleepingComputer reported that the breach affected 2.2 million people, and the company later confirmed the data theft after the ransomware group’s claims. BleepingComputer reported that the 2024 incident exposed the personal, financial and health information of the more than 2.2 million people affected, which is why the current statement’s careful wording about stolen data matters for shoppers and employees alike.
What remains open is the restoration date for U.S. online ordering, which the company described only as the coming days, and whether the investigation finds any data was taken. Albert Heijn’s Oct. 23 delivery restart is the next dated milestone in the company’s own timeline. Any later confirmation that Stop & Shop and the other U.S. brands are taking online orders again would come from the company’s newsroom, and shoppers who rely on the apps should expect the status to change as the recovery continues. The Oct. 19 update is the most recent company statement on record for this report.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
The day in tech, in one email: Get TLDR →
We may earn a commission if you sign up.
More from Morning Overview
- Regulators cleared the first U.S. small modular reactor, 4 months early
- Lake Powell sank to a record 3,517 feet, nearing the level that stops Glen Canyon Dam’s turbines
- Seven of Earth’s nine planetary boundaries are breached, and all seven are worsening
- The NSA says three phone features should be off whenever you aren’t using them
