Fraud Management & Cybercrime,
Incident & Breach Response,
Ransomware
Food Lion, Stop & Shop, and Albert Heijn Experience Order Disruptions Amid Cyber Incident
Ahold Delhaize, a multinational grocery retailer owning notable brands such as Stop & Shop, Hannaford, Giant Food, and Food Lion within the United States, found itself navigating a significant operational hurdle as it took numerous digital systems offline in response to a cyber incident believed to be linked to ransomware. This move was seen as necessary to contain the situation swiftly and effectively.
Based in the Netherlands, Ahold Delhaize revealed the cyber issue impacting its network on Monday, stating that it is implementing “precautionary measures” to safeguard its operations. Despite the digital disruption, Ahold Delhaize confirmed that its physical retail locations remain operational, much to the relief of loyal shoppers.
On the same day, various affiliated stores, including Albert Heijn, Etos—which operates as a drugstore—and Gall & Gall, a liquor outlet, disclosed that they had been confronting an internet-based incident since the previous afternoon. This prompted the stores to temporarily disable their websites, applications, customer service functions, and logistics systems to protect their operations and customers. Additionally, it was reported that the Belgian supermarket chain Delhaize also felt the ramifications of the cyber incident.
Ahold Delhaize is no stranger to cyber threats. It previously faced a severe challenge in November 2024, when a ransomware attack on its U.S. network led to the theft of personal, financial, and health information belonging to approximately 2.2 million individuals. The hacker group known as INC Ransom claimed responsibility for that breach, posting six terabytes of allegedly stolen sensitive data on its dark web extortion platform in April 2025. This incident raised alarm bells within the cybersecurity community and highlighted vulnerabilities in the retail sector, especially for large organizations managing extensive customer information.
Commenting on the current situation, security researcher Kevin Beaumont expressed concerns over the timeline of disclosure, noting, “The latest incident started a week ago, and they again waited a week to disclose and again didn’t say ransomware.” This reflects ongoing issues related to transparency in managing cyber incidents, a critical factor for maintaining customer trust and security.
Ahold Delhaize, in its statements sent to various media outlets, directed attention to its corporate website while indicating it is not in a position to disclose further specific details regarding the incident at this point. The ambiguity surrounding the cyber issues raises questions about the company’s overall cybersecurity strategy and its efficacy in addressing such pressing threats.
This company is one of the world’s largest food retail chains, generating impressive net sales of $103 billion in 2025 and employing around 384,000 associates across approximately 9,550 stores in the U.S. and Europe. Given its massive scale, the impact of cyber incidents extends beyond immediate operational disruptions, potentially influencing public perception and trust in the brand.
In the wake of the recent developments, employees at Food Lion took to platforms like Reddit to explore the ramifications of the “IT outage” that was communicated internally. Employees were instructed to spread awareness regarding the incident while ensuring clarity among customers during a tricky period for the stores. The guidelines set forth called for a leadership stance to manage customer expectations until more information could be communicated.
Meanwhile, employees from Stop & Shop expressed their concerns on Reddit about being unable to access critical functions such as viewing their schedules or paystubs on the Kronos Dimensions system, which serves as a timekeeping tool for the grocery chain. This technical failure was echoed by others who experienced a similar inability to access necessary operational information, heightening concerns about the impact on employee morale and operational efficiency.
The ripple effects of this incident have led to food retail workers at Food Lion reporting issues accessing their employee portals, along with Ahold Delhaize’s proprietary grocery order fulfillment and picking platform, named Spectrum. An employee mentioned on Reddit, “Spectrum was down last night for us; we could not scan out ToGo orders or receive them.” This snippet of information paints a picture of the operational challenges stemming from the cyber incident as the company works to restore normalcy.