AHOLD Delhaize disclosed on 19 October 2026 that a cyberattack forced the group to take most of its brand websites and mobile apps offline across Europe and the United States. The disruption affected a broad range of online shopping channels, with physical stores kept open during the incident.
The company said there was no evidence at that time that sensitive customer, associate or partner data had been stolen, though it was continuing the investigation and described the event as a cybersecurity incident rather than a confirmed data breach.
Initial indications show suspicious activity in Ahold Delhaize’s IT environment, prompting the engagement of external experts who confirmed that the activity resulted from malicious actions by others. The organisation began notifying authorities and began a careful recovery process, having already returned several brands online in parts of Europe while US brands reported ongoing e-commerce outages at various points.
In the Netherlands, Albert Heijn experienced notable disruption (with Bonus cards affected and some shelves reported to be empty) but later restoration progressed and home deliveries were slated to resume. Ahold Delhaize stated it had proactively offline certain systems and emphasised that the ongoing investigation would determine the scope and impact; no ransomware group had claimed responsibility at the time. The company pressed customers to rely on official brand channels for orders and refunds and warned of potential phishing tied to the incident.