Ahold Delhaize Digital Services Shutdown: Malicious Actors Triggered Precautionary Closures Across Continents

Ahold Delhaize proactively disconnected its IT infrastructure to contain a security incident, disrupting digital services for its US and European supermarket brands. According to The Register, the Dutch retail group confirmed on Monday that malicious actions caused the issue. This follows an initial disclosure on 12 October, as previously noted by Vector Bulletin.

Root cause

The company stated that "malicious actions of others" were responsible for the security problem within its network. Frans Muller, the president and chief executive, described the decision to take systems offline as a precautionary measure. He added that the ongoing investigation has so far confirmed this was the correct course of action to protect the infrastructure.

Attack path

The specific technical method used by the attackers was not disclosed in the public statements. Ahold Delhaize did not immediately respond to questions from The Register regarding whether this incident was linked to separate attacks on refrigeration controllers at French supermarkets that began on 11 October. The scope of the intrusion remains under investigation.

Affected versions

The outage impacted most of Ahold Delhaize’s brands across Europe and the United States. This includes US chains such as Food Lion, Giant Food, Stop & Shop, Martin’s, and Hannaford. European operations affected included Albert Heijn, Etos, Gall & Gall, and various brands in central and southeastern Europe.

Mitigation

• Albert Heijn’s website and app are back online, with home deliveries expected to resume on Friday.
• Belgian e-commerce services are fully operational again.
• US brand e-commerce services are expected to function in the coming days.
• The majority of websites and apps for central and southeastern European brands are up and running.

Why it matters

Security teams usually isolate networks to prevent lateral movement when a breach is detected. This approach sacrifices availability to ensure confidentiality and integrity. Readers should understand that taking systems offline is a standard containment strategy. It allows investigators to map the extent of the intrusion without risking further data exfiltration. Checking whether critical services are segmented helps limit the blast radius of such incidents in large retail environments.

Background: Lateral movement

Isolate compromised hosts immediately to stop the spread. Preserve forensic evidence before wiping drives. Reset credentials and patch vulnerabilities. Review access logs to map the full extent of the breach. Implement strict segmentation to limit future movement. Notify legal and regulatory bodies as required by law.

Read the full guide: Lateral Movement Response: Containment, Recovery and Prevention Steps

What to do and how to stay safe: Ahold Delhaize

• Monitor official communications from affected retailers for updates on service restoration timelines.
• Review account statements for any unauthorised transactions, although no data theft has been confirmed.
• Ensure multi-factor authentication is enabled on any associated online shopping accounts.
• Report any suspicious emails claiming to be from the retailer to the appropriate authorities.

Step-by-step guide: Password Policies Examples That Reduce Password Fatigue

General security guidance from the Vector Bulletin newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Was any customer data stolen in the Ahold Delhaize cyberattack?

The investigation has not uncovered any evidence to suggest that sensitive customer, associate, or partner data was stolen.

Are Ahold Delhaize physical stores still open?

Yes, all physical stores remain open during the digital service disruption.

Did Ahold Delhaize report the incident to authorities?

Yes, the company notified the Dutch National Cyber Security Centre and filed a report with the Dutch police.