Ahold Delhaize confirms cyberattack as grocery ordering outages persist

October 19 confirmation advances the incident beyond a security warning

Ahold Delhaize’s October 19 update explicitly attributed the disruption to malicious activity and announced a formal police report. The company had disclosed a network security issue on October 12, saying it took systems offline as a precaution, then announced a controlled restart on October 13 in a statement updated October 14. The latest announcement therefore clarifies the cause and response, but does not establish that attackers directly disabled every unavailable service. Protective shutdowns contributed to the disruption. [3][4][6]

The complaint also changes the public record of the company’s dealings with law enforcement. On October 14, NOS reported that police and prosecutors had urged Ahold Delhaize to file a complaint and that no criminal investigation was then underway. Filing on October 19 does not establish when an investigation began, since authorities can act without a complaint. Separately, the company said it notified the Dutch National Cyber Security Centre within 24 hours of discovering malicious activity. [5][6]

U.S. shoppers lose ordering access and face discount workarounds

By October 19, Food Lion, Giant Food, The Giant Company, Hannaford and Stop & Shop had experienced roughly a week of website and app outages. Grocery Dive documented halted in-house e-commerce and restricted access to loyalty programs and discounts. Physical stores remained open, so this was not a shutdown of the entire grocery business. Nevertheless, the disruption affected both customers ordering remotely and people relying on digital benefits while shopping in person. [1][7]

Grocery Dive obtained direct confirmations from Giant Food and The Giant Company about alternatives including kiosk coupon activation and automatic activation of weekly digital coupons. Lehigh Daily independently visited an open Giant store in Bethlehem Township on October 19, photographed outage-related coupon signage and obtained a spokesperson’s statement extending expiring rewards points. These reports corroborate practical disruption and functioning alternatives at store level. They do not demonstrate that the underlying online platforms had recovered. [7][8]

Albert Heijn’s delivery restart remains a forecast

Albert Heijn’s website and app were accessible again in its October 19 advisory, but ordering had not fully returned. Orders through Thursday, October 22 were canceled, with deliveries expected to restart gradually on Friday, October 23. Store replenishment had resumed. That specific company schedule should govern customer expectations rather than Reuters’ earlier wording that deliveries would not resume before Thursday. As of this October 20 briefing, the projected restart is still in the future, not a completed recovery. [2][9]

Recovery elsewhere was uneven. Ahold Delhaize said Etos and Gall & Gall websites were available and Belgian e-commerce was fully operational. For Central and Southeastern Europe, its statement covered a majority of brands’ websites and apps, not all services across the region. Read together with Albert Heijn’s limitations, these updates show why an accessible homepage cannot be treated as proof that ordering, fulfillment and related customer functions are operating normally. [2][6]

The attack method and any data exposure remain unresolved

The reviewed disclosures identify no entry vector, exploited product, vulnerability, malware family or perpetrator. They do not confirm encryption, an extortion demand or payment. Calling this a confirmed cyberattack is supported by the company’s malicious-activity finding; calling it ransomware is not. Ahold Delhaize also said its continuing investigation had found no evidence that sensitive customer, employee or partner data was taken. That remains a provisional company finding, not a completed forensic determination excluding access or theft. [6]

The no-evidence-of-theft assurance was already present in the October 13 statement updated October 14, so it should not be presented as a new October 19 discovery. Separately, Reuters reported that the Dutch NCSC saw no reason to believe the Netherlands incident was directly connected to cyberattacks in other countries. The available evidence therefore does not support a shared-campaign explanation or claims of a coordinated attack on European food supplies. [4][9]

The sources establish different things. The Record’s central attack-confirmation claims trace back to Ahold Delhaize, while Albert Heijn’s operational advisory comes from the same corporate group. Neither supplies independent forensic corroboration. Grocery Dive’s original reporting and Lehigh Daily’s observation independently document customer-facing effects, but do not establish technical attribution. Reuters, accessed through StreetInsider, adds the NCSC’s assessment; the syndicating site is not a second independent source for that assessment. [1][2][7]

Customer protection and continuity need separate attention

Albert Heijn said prepaid canceled orders would be refunded automatically and asked customers to keep receipts for missed benefits. Its customer service remained unavailable in the October 19 advisory, which also warned about phishing impersonating company staff. Those instructions give affected shoppers concrete steps while recovery continues: retain purchase records, distinguish automatic refund arrangements from unsolicited messages, and avoid assuming that a restored website means support or ordering is fully available. [2]

Our defensive assessment is that continuity testing should measure individual customer functions, not simply whether websites load. The documented gap between accessible pages and canceled deliveries, together with coupon workarounds in U.S. stores, supports testing ordering, fulfillment, discounts and support separately. Retailers can also examine whether fallback arrangements preserve benefits and communicate cancellations clearly. These are lessons inferred from the operational evidence, not findings about Ahold Delhaize’s internal architecture or the cause of its compromise. [2][7][8]

Watch actual ordering recovery and the next forensic disclosure

The next measurable milestones are restored U.S. ordering and Albert Heijn’s planned gradual delivery restart on October 23. The Record reported that U.S. online shopping was expected back in the coming days, without a firm date. Subsequent reporting should verify whether customers can place and receive orders, rather than treating projected dates or website availability as completion. The latest detailed operational updates verified in this dossier are from October 19. [1][2][6]

Further disclosures could change the security assessment if they establish the intrusion method, attacker identity or data exposure. Until then, the supported conclusion is narrower: malicious activity prompted a response that left important grocery services disrupted despite partial recovery and open stores. The public-interest significance lies in those demonstrated service failures, not in an unverified ransomware label, a presumed food shortage or a claimed connection to other attacks. [1][6][7][9]