Shoppers who tried to order groceries online from Stop & Shop, Food Lion, Hannaford or Giant on Monday, October 12, found the sites dark. Their parent company, Ahold Delhaize, said that day it was dealing with “a security issue within its network” and had taken systems offline to protect them. A week later it confirmed the Ahold Delhaize cyberattack was “the malicious actions of others,” but it still says it has found no evidence that customer data was stolen.
Where it stands: In its October 19 update, the company said U.S. e-commerce was “expected to come back in the coming days,” that Belgian online shopping was fully working again, and that Albert Heijn in the Netherlands planned to restart home deliveries on Friday, October 23. It had filed a formal report with the Dutch police that day. Whether the U.S. sites are fully back should be checked on each brand’s own site.
What the Ahold Delhaize cyberattack actually hit
This was an outage of digital services, not a store closure. Ahold Delhaize says stores stayed open throughout. According to Insurance Journal, in-store systems “including refrigeration and checkout systems have not been affected.”
What went down was everything that runs online. Supermarket News reported that “the websites of Food Lion, Hannaford, Stop & Shop and both Giant Food banners were all taken offline,” along with online ordering and deliveries. In Europe, customers of Albert Heijn, Etos and Gall & Gall in the Netherlands, and Delhaize in Belgium, also lost websites and apps, BleepingComputer reported. Some Stop & Shop workers reportedly could not see their schedules or pay stubs.
Brand-by-brand status as of the October 19 update
| Brand | Status reported by Ahold Delhaize |
|---|---|
| Stop & Shop, Food Lion, Hannaford, Giant Food, The Giant Company (U.S.) | Stores open; online services expected back “in the coming days” |
| Albert Heijn (Netherlands) | Website and app back; deliveries from October 23 |
| Etos, Gall & Gall (Netherlands) | Websites available |
| Delhaize and other Belgian e-commerce | Fully operational |
While the U.S. sites were down, notices on them pointed shoppers to third-party delivery. Cybersecurity Dive reported that Food Lion, Giant Food and The Giant Company told customers they could still order “through Instacart, DoorDash and Uber Eats.”
Was customer data stolen? Not according to the company
This is the part that matters most for shoppers, so plainly: Ahold Delhaize has not confirmed that any customer data was stolen. On October 13 it said it had “no evidence at this moment that customer and associate data was taken.” On October 19 it went a step further in wording, saying it had no evidence “that any sensitive customer, associate or partner data was taken.”
Two caveats keep that from being an all-clear. The investigation is still open, and “no evidence at this moment” is not the same as proof that nothing left the network. The company has also declined to give technical details, saying that sharing them could compromise its response. It has not said what kind of attack this was.
So the accurate label for now is a cyberattack that disrupted services. It is not a confirmed data breach, and you should be wary of anyone, in a headline or a text message, who says otherwise.
Not the 2024 breach, and not the French fridge attack
Two other incidents are worth keeping separate. The first is real history: in November 2024, BleepingComputer notes, the INC Ransom group stole personal, financial and health data of over 2.2 million people from Ahold Delhaize’s U.S. systems. If you received a letter about that breach, it relates to the earlier event, not this one.
The second is a separate attack in France in which hackers overheated refrigerators and freezers at hundreds of supermarkets. Insurance Journal reported that Ahold Delhaize said it believes that matter is unrelated. No source ties the two together.
What shoppers should and should not worry about
For most customers this is a nuisance, not an emergency. Here is how to sort the two. Our checklist of signs a grocery delivery account has been compromised is a useful companion.
Worth doing now:
- Watch for your refund. The U.S. brand sites said customers with unfulfilled online orders will receive refunds. If one does not show up on your statement, contact the store through its official website or app, not a link in an email.
- Expect fake refund messages. A well-publicized outage invites scams: emails or texts offering a refund, a gift card or a “verify your account” link. A genuine refund for an order you already paid for should not require you to type in your card number or password again.
- Call your pharmacy directly. The brand sites told shoppers to contact their local pharmacy with prescription questions; pharmacies stayed open on normal hours.
- Change a reused password. There is no sign passwords were taken, but if your grocery account shares a password with other sites, now is a sensible time to give it a unique one.
Not needed on current information:
- Cancelling or replacing a payment card solely because of this incident.
- Freezing your credit solely because of this incident, unless you were affected by the 2024 breach and have not already done so.
- Paying for identity monitoring. If the investigation later finds personal data was taken, breach-notification rules generally require the company to tell the people affected.
Ahold Delhaize told the Dutch National Cyber Security Centre within 24 hours of finding the activity, according to its October 19 update. Other incidents this month are tracked in our roundup of October 2026 breaches.
Frequently Asked Questions
Was customer data stolen in the Ahold Delhaize cyberattack?
Not as far as the company knows. In its October 19 update, Ahold Delhaize said it had no evidence, at that point, of sensitive data belonging to customers, staff or partners being taken. The investigation is still open, so that could change; if it does, notification rules would generally require the company to tell the people affected.
Are Stop & Shop, Food Lion and Hannaford stores open?
Yes. Ahold Delhaize says stores stayed open throughout, and the U.S. brands said stores and pharmacies were operating normal hours. The outage hit websites, apps and online ordering.
Will I get a refund for my canceled grocery delivery order?
The U.S. brands posted notices saying customers with unfulfilled online orders will be refunded. Check your card or bank statement for the refund, and contact the store directly, using contact details from its official site, if it does not appear.
Is this the same as the 2024 Ahold Delhaize data breach?
No. The November 2024 attack, attributed to the INC Ransom group, involved personal data of more than 2.2 million people. The October 2026 incident is a separate event, and data theft has not been confirmed.
Sources
- Ahold Delhaize takes precautionary measures following cybersecurity incident — Ahold Delhaize (press release), October 12, 2026
- Update on Ahold Delhaize’s cybersecurity incident — Ahold Delhaize (press release), October 13, 2026
- Ahold Delhaize update on status of cybersecurity incident — Ahold Delhaize (press release), October 19, 2026
- Retail giant Ahold Delhaize takes systems offline after cyberattack — BleepingComputer (Sergiu Gatlan), October 12, 2026
- Ahold Delhaize shuts down websites after cybersecurity issue — Supermarket News (Mark Hamstra), October 12, 2026
- Ahold Delhaize USA banners remain offline — Cybersecurity Dive (Catherine Douglas Moran), October 14, 2026
- Eastern States’ Grocers Shut Online Systems After Cyberattack — Insurance Journal, October 14, 2026
- Ahold Delhaize cybersecurity incident disrupts Stop & Shop, Food Lion — Fox News (CyberGuy, Kurt Knutsson), not shown on cached page (references updates of Oct. 13 and Oct. 14, 2026)
This article is news reporting and general security information based on the public sources listed above, as they stood on the dates shown. Incident details often change as investigations continue; check the affected company’s own status page and notices for the latest. Data Breach Radar is not affiliated with any company named here.