Ahold Delhaize cyberattack knocks Albert Heijn and US grocery banners' websites offline

On 12 October 2026, Ahold Delhaize — the Zaandam, Netherlands-based retail group that operates grocery chains across Europe and the United States — confirmed it was dealing with a security issue within its network and had taken a range of systems offline to protect them. The company said the disruption had begun the previous afternoon, a Sunday, and that it had responded by shutting down affected systems while it assessed and worked to contain the incident.

The outage rippled across many of the group's best-known banners. In Europe, the websites, apps and customer-service channels of Albert Heijn, Delhaize, Etos, Gall & Gall and bol.com were knocked out, and in the United States the online storefronts of Food Lion, Hannaford, Stop & Shop and the group's Giant banners were unavailable. Albert Heijn's logistics systems went down as well, suspending deliveries of online grocery orders until further notice.

Impact

Physical stores stayed open throughout, with point-of-sale systems and weekly in-store promotions still functioning, but the digital disruption was wide-ranging. Albert Heijn warned that systems tied to its loyalty programme — including the Mijn AH app, the Bonus Card, Mijn Bonus Box, Koopzegels and Air Miles — were affected, and it asked customers who missed personal discounts to keep their receipts for later compensation. Reports also noted that electronic shelf labels in some stores still displayed the previous week's promotional prices, meaning the price shown at the shelf could differ from the price charged at the register.

Response and open questions

Ahold Delhaize said its teams were "taking steps to assess and mitigate the issue," which it stressed "includes taking some systems offline to help protect them," and that protecting its infrastructure in the interest of customers, associates and partners was a top priority. Albert Heijn separately told customers it could not yet say when its services would be restored.

As of its initial disclosure, the company had not identified an attacker, had not characterised the incident as ransomware or a confirmed data breach, and had not said whether any customer or employee data had been accessed. The incident recalls a November 2024 cyberattack that disrupted Ahold Delhaize's US operations and was later tied to the theft of data affecting more than two million people, and it lands amid a broader wave of attacks on European and American retailers in 2026.