title: "Ahold Delhaize Restores Services After Cyberattack Disruption" metaTitle: "Ahold Delhaize Restores Services After Cyberattack Disruption" metaDescription: "Ahold Delhaize reported a staged recovery after a cyberattack disrupted digital and employee services across Europe and the US, while stores remained open." ogTitle: "Ahold Delhaize Restores Services After Cyberattack Disruption" ogDescription: "Ahold Delhaize reported a staged recovery after a cyberattack disrupted digital and employee services across Europe and the US, while stores remained open."
Ahold Delhaize service disruption: recovery across Europe and the US
What the incident confirms
Ahold Delhaize said a cyberattack disclosed the previous week forced the company to take some systems offline, disrupting services at its retail brands in Europe and the United States. In an October 20, 2026 report, BleepingComputer described the company’s Monday update: stores remained open, but websites, apps and other services were affected while the company worked to restore systems. The incident’s reported effects reached customers and employees even as physical stores continued operating.
The company has not publicly provided a technical account of the intrusion. It has not identified the attackers or described their method, confirmed ransomware or encryption, or set out which corporate and store systems were accessed. Those questions remain open; an outage alone does not establish a particular malware family, data theft or compromise of operational technology.
Ahold Delhaize said its ongoing investigation had not found evidence that sensitive customer, associate or partner data was stolen. This describes the findings at the time of the update; it does not establish that no data was accessed or that the investigation is complete. The company said it would not share further details that could interfere with response efforts or compromise security measures.
Timeline and restoration across brands
The disruption became visible to customers shortly before the cyberattack was disclosed. BleepingComputer reported problems with websites, apps and customer-service platforms for Albert Heijn, Etos and Gall & Gall in the Netherlands, and Delhaize in Belgium. At Stop & Shop in the United States, employees reported difficulty accessing schedules and pay stubs. These reports identify a range of affected services, but do not establish that every service was unavailable for the same period or for the same technical reason.
In its Monday update, Ahold Delhaize said it had taken some systems offline as part of its response. Stores stayed open. By the time of the report, most store websites and apps in Central and Southeastern Europe were back online, while some services for European and US brands were still being restored.
The company gave several specific milestones. Albert Heijn’s website and app were back online, with home deliveries expected to resume Friday, October 23. Etos and Gall & Gall websites were available. E-commerce in Belgium was described as fully operational. E-commerce services for Ahold Delhaize’s US brands were expected to return in the coming days. The distinction between a website being available and related services being restored is important: the update separately described Albert Heijn’s site and app as online and deliveries as due to resume later.
These dates and status reports reflect the company’s update as reported on October 20, not a guarantee of later conditions. The report did not give a complete brand-by-brand outage duration, a final recovery date for every affected service, or a detailed account of residual limitations.
Effects on shoppers and employees
For shoppers, the reported effects centered on digital channels and e-commerce. Ahold Delhaize’s separate updates about Albert Heijn’s app and website being online and deliveries expected to resume later show that access to a digital service did not necessarily mean every related service was available.
Employees also faced practical consequences. Stop & Shop workers reportedly had trouble accessing schedules and pay stubs. The report does not say that payroll itself failed, that pay was delayed, or how many employees were affected; it documents access problems with employee information.
BleepingComputer states that Ahold Delhaize operates 9,551 stores, employs more than 384,000 people and serves 77 million customers weekly across the United States, Europe and Indonesia. These figures describe the group, not the number of users or locations affected by this incident. The report does not quantify the incident’s footprint.
Response and limits of the public account
Ahold Delhaize said it notified the Dutch National Cyber Security Centre within 24 hours of discovering malicious activity, continued providing updates to the NCSC, law enforcement and other relevant regulatory authorities, and filed a formal police report with Dutch police on Monday. These are the response steps described in the company’s update; the report does not disclose investigative conclusions from authorities.
The company’s decision to take systems offline was part of its response, but the public account does not identify precisely which systems were isolated or why each was taken offline. It also does not say whether the initial cause involved compromised credentials, a software vulnerability, a third party or another route. Those remain unknown without further findings.
BleepingComputer notes a previous major attack affecting Ahold Delhaize’s US systems in November 2024, in which personal, financial and health information of more than 2.2 million people was stolen. The outlet reported that INC Ransom claimed that earlier attack. This is relevant background, but does not establish a connection to the 2026 incident or show that the same group or technique was involved. The current report does not attribute the attack to a named actor.
What remains unknown
The cited coverage confirms that some systems were taken offline, stores continued operating, named digital services and employee portals experienced difficulties, and restoration was progressing differently by brand and service. It does not establish the intruder’s identity, initial access method, whether files were encrypted, the full number of affected users, whether data was accessed, or the final scope of recovery.
The incident details here come from BleepingComputer’s October 20, 2026 report, which quotes Ahold Delhaize’s update and records the publication’s questions about corporate and store systems. The company declined to provide further technical specifics while response and investigation continued. New company or regulator statements could change the picture; conclusions should remain tied to the dated update.
The most useful future updates would clarify whether all affected e-commerce and employee services have returned, whether investigators found unauthorized access or data exfiltration, and whether the company can provide a clearer timeline and incident scope. Any attribution or account of technical cause should be evaluated against a direct company, regulator or law-enforcement statement, rather than inferred from service disruption.
Customers and employees can follow the relevant brand’s official service notices for operational status. If Ahold Delhaize or authorities later report that personal information was involved, people should rely on the specific advice in that notice. At the time of the cited update, the documented picture was a cross-market service disruption, a staged restoration and an investigation with limited public findings.
Source: BleepingComputer, “Ahold Delhaize: Cyberattack affects services across US and Europe” (October 20, 2026).
