Ahold Delhaize’s ‘right decision’ and the price of pulling the plug

On 19 October, a week after it first said it had taken systems offline, Ahold Delhaize gave its fullest account yet of the cybersecurity incident in which it took brand websites and apps offline, affecting most of its brands in Europe and the US. In a statement issued from Zaandam, Frans Muller, president and chief executive, said: “Taking systems offline to help protect them was a precautionary measure that affected most of our brands across Europe and the United States. The investigation to date confirms this was the right decision.”

Ahold Delhaize runs 9,551 stores serving 77 million customers a week, with 384,000 associates across 17 local brands in nine countries, according to its own figures. All of those stores stayed open throughout the incident, the company said. The disruption was to the online services around them: websites, apps and home delivery.

On 12 October the company said it was “experiencing a security issue within its network” and was taking some systems offline. On 13 October it said it was starting a controlled relaunch of certain systems. By 19 October the Albert Heijn website and app were back, with home deliveries due to resume on Friday 23 October; the Etos and Gall & Gall sites were available; ecommerce in Belgium was fully operational; and online services at the group’s US brands were expected back “in the coming days”. The Record reported that online shopping at Food Lion and Stop & Shop was not yet working.

Muller’s statement defends a choice to give up large parts of the group’s online business for more than a week in order to protect its systems. It has not said what that cost; its third-quarter results on 4 November are the next scheduled point at which it speaks to investors.

What the shutdown kept and what it took

The company has addressed data in two statements. On 13 October it said it had no evidence that customer, associate and partner data was taken. On 19 October it said it had “no evidence at this moment that suggests that any sensitive customer, associate or partner data was taken”, adding that the investigation was still running. It said it had notified the Dutch National Cyber Security Centre within 24 hours of discovering the malicious activity.

Ahold Delhaize has not described the nature of the attack or named anyone behind it. It said it was “not sharing further details that could compromise security measures or interfere with our response efforts”. BleepingComputer asked whether devices had been encrypted; a spokesperson pointed the outlet back to the published statement.

The disruption also reached staff: BleepingComputer reported that Stop & Shop employees had said on Reddit that they had trouble accessing their schedules and pay stubs. Recovery has run brand by brand, from Belgian ecommerce, fully operational by 19 October, to US ecommerce with no fixed return date.

A cost the company has not priced

Ahold Delhaize has given no figure for lost online sales, for the recovery work or for the home deliveries at Albert Heijn, which are not due to restart until 23 October, 11 days after the first disclosure. The 4 November results are the first scheduled occasion on which a number could appear.

An earlier incident at the group’s US business surfaced in November 2024 and was later claimed by the INC Ransom group. Food Lion, Hannaford, Giant Food, The Giant Company and Stop & Shop were among the brands disrupted, and Ahold Delhaize said 2,242,521 people were affected, according to SecurityWeek. In that incident personal information was compromised; in this one, the company has so far reported disruption to online services and no evidence that sensitive data was taken.

Muller’s claim that the decision was right rests on the investigation “to date”, and the company has said that the investigation is still running.

What the open stores made possible

Ahold Delhaize’s statements set out what it took offline, what it kept open, when it told the authorities and, brand by brand, when services came back. Its stores stayed open throughout, so taking the websites and apps offline cost the group one sales channel while the rest of its trading continued. For a company that sells mainly through a website or app, the same step would stop most of its trading.

On disclosure, the company treated the incident as price-sensitive from its first statement, told the authorities within a day and issued three statements between 12 and 19 October, the later ones saying more about restoration than about the attack.

Muller’s “right decision” is a judgment Ahold Delhaize could make with every store open and no evidence so far of sensitive data leaving its systems. The group kept large parts of its online business switched off in Europe and the US for more than a week rather than run them while the investigation was under way, and its stores, open throughout, are what let it make that choice without halting its trade.