Circuit Wire — a daily news update from the Circuit.
Dutch grocery giant Ahold Delhaize said on Monday that a cyberattack forced it to take systems offline across most of its US and European brands.
The company confirmed that suspicious activity detected in its IT systems the previous week was caused by "malicious actions." It filed a police report in the Netherlands on Monday and said it notified Dutch cybersecurity authorities within 24 hours of detection. Stores stayed open, but online services were disrupted in the US, the Netherlands and Belgium.
Recovery is under way in phases. US online shopping at brands including Food Lion and Stop & Shop was not yet working, with a return expected in the coming days. Dutch websites and apps for Albert Heijn, Etos and Gall & Gall are back online, although Albert Heijn home deliveries are not expected to resume until Friday. E-commerce has been restored in Belgium and in Central and Southeastern Europe.
Ahold Delhaize has not described the nature of the attack or said whether a ransom was demanded. It said it is "not sharing further details that could compromise security measures or interfere with our response efforts." The company added that it has no evidence sensitive customer, employee or partner data was stolen, and that the investigation continues. CEO Frans Muller apologized for the disruption and called the shutdown a necessary precaution.
BleepingComputer reported on October 12 that the company first confirmed a "security issue within its network" and took some systems offline. Stop & Shop employees reported trouble accessing schedules and pay stubs at that stage. An internal Food Lion memo warned that stores might be unable to shop, stage or hand off customer orders.
The group runs more than 9,400 local stores, employs nearly 400,000 people and serves about 60 million customers a week, according to the same report. Its US brands include Food Lion, Stop & Shop, Giant Food and Hannaford. In Europe, its banners include Albert Heijn, Delhaize, Etos and Gall & Gall.
The retailer has been targeted before. A ransomware attack by the INC Ransom group in November 2024 hit its US systems, and the stolen personal, financial and health data affected more than 2.2 million people.
Want a weekly roundup of the major stories shaping the security industry? The On The Circuit newsletter is read by more than 12,000 protection professionals.
Spotted something we should cover? Send tips and feedback via circuit-magazine.com.