Ahold Delhaize IT Infrastructure Offline to Contain Security Issue, Impacts US and EU Digital Services
The retail giant has taken IT infrastructure offline to contain a security issue, affecting digital services across Europe and the US while physical stores remain open.
Key points
- Ahold Delhaize disconnected network systems to mitigate an unconfirmed security incident.
- Digital services for Albert Heijn, Etos, and US chains are currently unavailable.
- Physical retail locations remain open, though checkout and ordering functions are impaired.
Ahold Delhaize has initiated a network-wide containment procedure by taking specific IT systems offline in response to an identified security issue. The company, which operates over 9,400 stores across Europe, the United States, and Indonesia, confirmed the incident in a press release. Teams are currently assessing the scope of the disruption while attempting to limit further impact on corporate and retail infrastructure.
Root cause
The precise origin of the security issue remains unconfirmed. Ahold Delhaize has not disclosed whether the incident involves ransomware, unauthorized data access, or a specific vulnerability exploitation. The company stated it is taking systems offline to help protect them, describing the action as a protective measure rather than a response to confirmed data exfiltration. No attacker has been named, and no entry point has been identified in the initial disclosure.
Attack path
Information regarding the attack vector is currently unavailable. The company did not specify how the security issue was introduced into the network or which specific components were targeted. Consequently, the full scope of the incident, including whether corporate or store-level systems were compromised, remains unresolved. SecurityWeek noted that it is unclear if this event is related to previous attacks on supermarket refrigeration systems in Europe.
Affected versions
The incident impacts multiple brand ecosystems within the Ahold Delhaize portfolio. According to reports from Cyber Security News and local media, the following services and brands are experiencing disruptions:
- Albert Heijn: Websites, apps, and home delivery services are offline; personal discounts are paused.
- Etos and Gall & Gall: Customer service and logistics systems are reported offline in the Netherlands.
- Delhaize: Delivery and online order systems are affected in Belgium.
- US Chains: Websites for Food Lion, The Giant Co., Giant Food, Hannaford, and Stop & Shop are unavailable.
Mitigation
Ahold Delhaize is actively working to assess and mitigate the issue. The primary mitigation strategy involves disconnecting affected systems from the network to prevent potential lateral movement or further compromise. Physical stores remain open to customers, although operational capabilities such as order staging and handoff may be limited. Employees at Stop & Shop have reported difficulties accessing schedules and pay stubs due to the system shutdowns.
Background: Lateral movement
Isolate compromised hosts immediately to stop the spread. Preserve forensic evidence before wiping drives. Reset credentials and patch vulnerabilities. Review access logs to map the full extent of the breach. Implement strict segmentation to limit future movement. Notify legal and regulatory bodies as required by law.
Read the full guide: Lateral Movement Response: Containment, Recovery and Prevention Steps
What to do and how to stay safe: Ahold Delhaize
- Monitor official communications from affected retailers for updates on service restoration timelines and potential data exposure.
- Review account statements and transaction histories for any unauthorized activity if you have used digital services with these brands recently.
- Avoid entering sensitive personal or financial information on affected websites or apps until services are confirmed secure.
- Once the vendor provides an update, verify if any customer data was compromised and adjust password protections accordingly.
Step-by-step guide: Password Policies Examples That Reduce Password Fatigue
General security guidance from the Vector Bulletin newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Are Ahold Delhaize physical stores still open?
Yes, the company confirmed that physical stores remain open and are serving customers, although some operational functions like order staging may be impaired.
Has Ahold Delhaize confirmed if customer data was stolen?
No, the company has not confirmed whether any data was stolen, encrypted, or accessed during this specific incident.
Is this incident related to the previous ransomware attack?
It is currently unclear if this incident is related to the November 2024 ransomware attack that affected US systems and compromised data of over 2.2 million individuals.
