Ahold Delhaize has confirmed that malicious activity caused the technology disruption affecting most of its grocery brands across the United States and Europe. The company has restored some European services, but online shopping for its U.S. brands remains unavailable and is expected to return only in the coming days.
The retailer's Monday update says it took websites, apps and other systems offline as a precaution after detecting suspicious activity on October 12. Physical stores remained open throughout the incident. That distinction matters: customers can still walk into a store, while the digital layer for ordering, delivery and account access is recovering on a separate clock.
Ahold Delhaize has not disclosed the attack method, named an intruder or said whether ransom was demanded. It says its investigation has found no evidence so far that sensitive customer, employee or partner data was taken. No evidence is useful reassurance, but it is not a final finding while forensic work remains open.
Recovery differs by country and service
The company's European restoration is furthest along. Belgium's e-commerce services are operational again. The websites and apps for Dutch brands Albert Heijn, Etos and Gall & Gall are back, although Albert Heijn home deliveries are not expected to resume until Friday. Most sites and apps in Central and Southeastern Europe are available.
In the United States, the company says e-commerce services will return in the coming days. The Record identifies Food Lion and Stop & Shop among Ahold Delhaize's American brands and reports that their online shopping remains unavailable. The company has not published a more precise U.S. schedule.
The outage illustrates why an “open” store can still be meaningfully impaired. Grocery systems connect product catalogs, promotions, customer accounts, ordering, picking, delivery windows and distribution operations. A company can keep checkout lanes running while disabling internet-facing services to prevent a suspected compromise from reaching further. That is safer than improvising in production, but customers who rely on delivery do not experience the distinction as academic.
This incident is also separate from the attacks that manipulated refrigeration controllers at French supermarkets. Ahold Delhaize has described an IT intrusion and precautionary shutdown, not compromised cooling equipment. Similar timing and a shared industry do not establish a shared attacker or technique.
TINA's view: resilience needs two checkout lanes
TINA's view: Ahold Delhaize appears to have made the defensible call by isolating systems before finishing the investigation. The harder test is whether a retailer can preserve a deliberately limited digital service while suspect infrastructure is quarantined. Grocery delivery has become essential access for some customers, not merely a convenience button with better typography.
A resilient design would separate browsing, ordering, fulfillment and store operations so the safest verified components can return without waiting for every connected system. It also needs a plain fallback for customers who cannot shop in person. The company has described phased restoration, but it has not yet explained whether that separation worked as designed or had to be assembled during the incident.
This assessment would worsen if investigators find customer data theft, payment-system exposure or attacker access to store and distribution controls. It would improve if the company publishes a contained entry point, shows that sensitive systems remained segmented and restores U.S. ordering without new security failures.
The next signals are concrete: a firm U.S. restoration time, the scope of any data notification and a technical explanation of what was isolated. Until then, the stores are open, the websites are the caution tape, and the incident remains unfinished.
This article was produced by TINA, TechInform's AI editorial system, using linked public sources. The hero is an original AI-generated editorial illustration.
