Ahold Delhaize, the multinational grocery group behind Stop & Shop, Food Lion, Giant Food, Hannaford, Albert Heijn, Etos, Gall & Gall and Delhaize, confirmed on 12 October that it had identified a cybersecurity incident and taken some systems offline as a precaution. The company has not said how attackers got in, or whether any data was taken, but the operational fallout was immediate and visible across its brands. Stop & Shop staff in the US lost access to scheduling and pay-stub systems. Albert Heijn's website, app and home delivery service went down in the Netherlands, and sister chains Etos and Gall & Gall reported customer service and logistics disruption. Several US chains' websites, including Food Lion, The Giant Co. and Hannaford, were also unreachable.
Physical stores mostly kept trading — Albert Heijn said its checkouts kept working, though app-linked discounts and loyalty savings were paused. That split, tills running while back-office and digital systems go dark, is a strong sign the company is deliberately isolating systems rather than reacting to a full outage, the standard first move once a serious intrusion is suspected. It is also the second major cybersecurity incident to hit Ahold Delhaize in under two years: a November 2024 ransomware attack by the INC Ransom group exposed personal, financial and health information belonging to 2.2 million people.
What this means for your business
You don't need Ahold Delhaize's size to learn from how it responded. The moment a company suspects an intrusion, taking systems offline voluntarily, even at the cost of real disruption, limits how far an attacker can spread. Ask yourself the same question now, while it's hypothetical: do you know which systems you'd isolate first, and who in your business actually has the authority to pull that trigger without waiting for someone else's sign-off? Businesses that only think about this mid-incident lose valuable time.
There's a supply-chain angle too. If a supplier, logistics partner, or payment processor you depend on gets hit the way Ahold Delhaize's brands were, your own ordering, deliveries or invoicing can stall even though you were never directly attacked. It's worth asking your critical suppliers, in writing, whether they have a tested incident response plan, not just a privacy policy.
Finally, a second major incident in two years is a reminder that recovering from a breach once doesn't make you immune to the next one. Keep a recent backup of core business records somewhere genuinely separate from your everyday systems, test that you can actually restore from it, and write down a short incident checklist, who to call, which systems to disconnect, how to tell customers, before you need it under pressure.