Eight grocery banners offline, cause unstated

Ahold Delhaize, the Dutch supermarket group, said on Monday that it is "experiencing a security issue within its network" and has taken some systems offline to protect them, according to a statement issued from Zaandam at 08:29 CEST. The company said its stores are open and serving customers. It gave no cause, no timeline for restoring the systems and no list of the banners affected. The release was flagged as containing inside information under the EU Market Abuse Regulation.

The statement runs to six sentences. It says the company's teams are taking steps to assess and mitigate the issue and that "Protecting our infrastructure in the best interest of our customers, associates and partners is a top priority." It does not say which systems are down or whether any data has been taken. Asked for more, Ahold Delhaize told BankInfoSecurity by email that "we are not in a position to disclose additional details".

Grocery Dive reported that the websites of all five Ahold Delhaize USA banners (Hannaford, Stop & Shop, Giant Food, Food Lion and The Giant Company) were down on Monday morning, along with those of Albert Heijn, Etos and Gall & Gall in the Netherlands. The US unit told the outlet it had no statement beyond the release and no timeline for bringing systems back. By our count that is eight banners with their websites offline.

In the Netherlands the disruption is wider. Albert Heijn said the problems began on Sunday afternoon, and NOS reported that the websites, apps and customer service of Albert Heijn, Etos and Gall & Gall were unavailable, online orders were not being delivered, electronic shelf labels still showed the previous week's promotional prices and loyalty schemes were not working, a point Marketing Tribune also reported. In Belgium, Delhaize customers could not place new orders for this week and customer service was unreachable, though its app and website worked; Delhaize told VRT NWS that all its stores in Belgium and Luxembourg remain open.

The supply chain is also affected. RD reported that Margaret Versteden-Van Duijn, who retains overall responsibility for Albert Heijn, Etos and Gall & Gall, told NOS that work had stopped entirely at several Albert Heijn distribution centres. NL Times, citing RTL Z, reported that only the Zaandam centre was still operating, according to an email sent to a supplier; Komposite has not seen that email. "Product availability will vary by store in the coming days, depending on deliveries," Albert Heijn said in a statement quoted by NL Times, adding that fresh produce such as vegetables and fruit would be less available than frozen goods and bread.

No cause or attacker has been named. A police spokesman told Hart van Nederland that no criminal offence had been established so far, and Ahold Delhaize saw no reason to link the incident to an attack on French supermarket refrigeration systems reported the same day. BankInfoSecurity said experts suspect ransomware, which is a suspicion rather than a finding. It also quoted the security researcher Kevin Beaumont as saying: "The latest incident started a week ago and they again waited a week to disclose, and again didn't say ransomware." That conflicts with the Sunday-afternoon start given by Albert Heijn, and neither account has been independently verified.

The group has been here before. Cybersecurity Dive reported last year that a filing with the Maine attorney general put the number of people affected by its late-2024 cyberattack at about 2.2m, including nearly 100,000 Maine residents; intruders reached one database on 5 and 6 November, and a group called Inc Ransom claimed responsibility. That incident took banner websites offline and suspended Hannaford's online ordering for a time, Grocery Dive noted. By our count, Monday's disclosure comes about 23 months after those intrusions.

Investors marked the shares down. RD reported that Ahold Delhaize was the biggest faller among Amsterdam's main shares on Monday, almost 3 per cent lower, and NL Times put the close at €31.38. None of the reports reviewed carried a company estimate of the cost, and the company has not said whether customer or employee data was taken.

The difference from 2024 is reach: the earlier attack centred on US websites and e-commerce, while this one also touches Dutch logistics and Belgian ordering. Komposite reported last week on a ransomware attack that left a Japanese cloud's customers restoring from their own backups, and earlier on why insurers now write the security baseline. Ahold Delhaize has given neither a cause nor a recovery date.