If you tried to place an order, check store info, or pull up a loyalty account and everything felt… broken, you’re not imagining it. Ahold Delhaize confirmed a cyberattack that forced key systems offline, and that ripple hits regular people fast: apps don’t load, deliveries pause, and scammers suddenly have a “perfect excuse” to target customers with fake order and delivery messages. Here’s what actually happened, what’s back, what’s still shaky, what Ahold Delhaize says about data theft so far, and the exact steps you should take tonight to protect yourself.
What happened (and what it broke): the plain-English version
Ahold Delhaize confirmed a cyberattack that triggered a very specific kind of chaos: not “every store is closed,” but “the digital stuff you rely on suddenly stops working.” The company said it took some systems offline as part of its response, including brands’ websites and apps, which led to service issues while stores remained open.
That “took systems offline” line matters. When a retailer suspects an attacker is inside, the safest move is often to pull the plug on parts of the network to stop the spread, cut off access, and protect systems that haven’t been hit yet. It’s frustrating for customers, but it’s also one of the fastest ways to contain damage while the incident response team figures out what’s touched and what isn’t.
What customers actually saw
Right before the incident was publicly discussed, reports showed customers couldn’t use websites, apps, and customer service platforms for multiple brands. That translates to real-life breakage like:
- Apps not loading (no digital shopping list, no account access)
- Websites timing out (can’t check store info, orders, or promos)
- E-commerce disruptions (home delivery delays, order changes getting stuck)
- Customer service portals going dark (harder to get help or confirm order status)
Brands called out in public reporting
This wasn’t limited to one logo. Service disruptions were reported across Ahold Delhaize brands including Albert Heijn, Etos, Gall & Gall, and Delhaize.
And in the U.S., the impact showed up differently: Stop & Shop employees reported issues accessing work schedules and pay stubs, which is a strong hint that internal employee tools were also affected.
If you’re thinking, “Okay, but how does an outage turn into risk for me?” here’s the uncomfortable truth: when a big retailer is in the news for a cyberattack, scammers don’t waste time. They use the confusion to send “order problem” or “delivery update” messages that look perfectly believable.
What’s back vs. what’s not: a simple status + timeline you can follow
When a retailer says “services are being restored,” it usually means some things come back quickly (public websites), while other pieces take longer (payments, delivery workflows, employee systems). Ahold Delhaize’s own update gives a clearer, practical snapshot of what’s working again and what’s still in progress.
Quick status: what’s back (per Ahold Delhaize)
- Albert Heijn website + app: back online
- Etos website: available for customers
- Gall & Gall website: available for customers
- Belgium e-commerce: “fully operational”
Timeline items you can actually plan around
- Albert Heijn home deliveries: expected to resume from Friday, October 23
- Ahold Delhaize USA brands e-commerce: expected to come back in the coming days
A small but important read-between-the-lines point: “in the coming days” is not a date. If you’re in the U.S. and ordering online, assume start/stop availability until the brand you use posts a direct confirmation.
How to check service status without getting scammed
Cyberattack news creates the perfect cover story for phishing. Your rule should be simple: trust what you can reach on your own, ignore what’s pushed to you.
Use:
- Official brand newsroom pages (type the URL yourself or use a bookmark)
- In-app notices (open the app directly; don’t follow “status update” links)
Avoid:
- Any text or email that says “Service restored—tap to reschedule” or “Confirm your delivery” with a link, even if it uses the right brand name. During outages, that’s exactly how scams get clicks.
If you need a safe habit: open your browser, search the brand name + “newsroom,” and compare what you see there with what a message claims. If it doesn’t match, treat it as hostile.
Ahold Delhaize’s response steps (and what they signal to you)
Once basic services start coming back, the next question is the one people don’t love asking: How serious was this, really? Ahold Delhaize’s own timeline gives a few signals that this wasn’t treated as a minor IT hiccup.
What the company says it did — in plain terms
Ahold Delhaize said it:
- Notified the Dutch National Cyber Security Centre (NCSC) within 24 hours of discovering malicious activity
Signal for you: incidents that trigger fast national reporting usually aren’t “someone forgot a password.” They’re treated as potentially high impact.
- Kept providing updates to the NCSC, law enforcement, and other relevant regulatory authorities
Signal for you: when multiple authorities are in the loop, the company is balancing restoration with evidence preservation and legal obligations.
- Filed a formal police report with the Dutch police
Signal for you: police reports aren’t PR. They’re paperwork, and they usually mean the company expects this to be investigated as a crime.
None of this guarantees your info was exposed. It does mean the company treated the cyberattack as real and active.
The big question: was data stolen?
Ahold Delhaize said its ongoing investigation has not yet found evidence that sensitive customer, associate (employee), or partner data was stolen .
That wording is careful. Here’s what it means in practice:
- “No evidence so far” isn’t the same as “no data theft.” It’s a point-in-time finding while systems are being analyzed.
- In the early days of a cybersecurity incident, teams are focused on containment and restoration. Proving what did or didn’t leave the network can take longer.
- Attackers also play games with timing. Even if data wasn’t stolen, they may still try follow-on scams (fake refunds, fake delivery reschedules) because the public attention makes those messages feel believable.
So take the statement seriously, but don’t let it lull you into clicking “account verification” links. Staying alert for a couple of weeks is the smart move.
Your next 30 minutes: practical steps to reduce fallout (even if you weren’t directly affected)
Ahold Delhaize says there’s no evidence yet that sensitive customer, employee, or partner data was stolen . That’s good news.
Still, the highest-probability risk right now is follow-on scams (fake delivery issues, fake refunds, “your account is locked” messages). Here’s a tight checklist you can knock out fast.
1) Check money first (5 minutes)
Focus on what can hurt you today:
- Payment cards & bank account alerts: look for small “test” charges, then larger ones.
- Recent online grocery orders: confirm there aren’t surprise substitutions, address changes, or new saved cards.
- Loyalty accounts: check points balance and your saved email/phone/address.
If something looks off, don’t wait. Call your bank using the number on the back of your card.
2) Fix password risk (10 minutes)
Retail cyberattacks often lead to credential stuffing: attackers try leaked passwords on other sites.
Do this in order:
- Change the password on the affected retailer account(s) you use.
- Change any other account where you reused that same password (email inbox and banking apps come before everything else).
- Turn on MFA (multi-factor authentication) anywhere it’s available, especially your email.
Tip: If you can only do one thing tonight, lock down your email account. If someone gets into your inbox, they can reset passwords everywhere.
3) Treat delivery texts and “status updates” as hostile (10 minutes)
Red flags for phishing and fake delivery texts:
- Urgency: “Last chance to confirm” / “Delivery cancelled unless…”
- Strange links: shortened URLs, misspellings, or a domain that isn’t the official brand
- Requests for payment or “verification” outside the official app
Safest habit: don’t click the link. Open the official app or type the website yourself.
4) If you see real identity-abuse signals, freeze credit (5 minutes)
A credit freeze is worth it if you spot:
- New accounts you didn’t open
- Collections notices that aren’t yours
- Address/name changes you didn’t request
Freezing is annoying, but it blocks a lot of “open an account in your name” fraud.
5) One simple move that reduces future blast radius: mask your contact info
Even when a company says “no evidence of data theft yet,” scammers can still target customers because the event is public . One way to limit damage over time is to stop handing out your real email and phone number everywhere.
Tools like Cloaked let you use masked emails and phone numbers (aliases) for retailer accounts. If an alias starts getting spammed or shows up in a scam campaign, you can disable that alias without changing your real number or main inbox everywhere else. It’s a practical containment move, not a magic shield.
If you do nothing else: change reused passwords, turn on MFA, and stop clicking “delivery problem” links.
How this compares to the 2024 Ahold Delhaize incident (and why repeat events change your risk)
If you’re trying to gauge your personal risk, it helps to separate two very different outcomes: service disruption vs. confirmed data theft.
2026 incident: disruption first, data-theft unconfirmed (so far)
In the current cyberattack, Ahold Delhaize says its investigation has not yet found evidence that sensitive customer, associate, or partner data was stolen.
That’s not a guarantee. It’s a status update while restoration and forensics are still happening.
2024 incident: confirmed theft at scale
Ahold Delhaize also dealt with a major U.S.-impacting attack in November 2024, where personal, financial, and health information of over 2.2 million individuals was stolen, and the incident was claimed by the ransomware group INC Ransom.
So the difference is sharp:
- 2026: systems hit, customer-facing services disrupted, no evidence of sensitive data theft yet
- 2024: data theft confirmed, 2.2M+ affected, ransomware group claim
Why repeat events change your risk (even if you did “everything right”)
Attackers don’t need your data to make money during a headline incident. They just need you to believe the story.
Repeat events give scammers:
- A credible reason to send “delivery issue” or “refund pending” messages
- A believable excuse to ask you to “verify your account”
- Better timing, because people are already frustrated and looking for updates
The behavior shift that actually protects you
Treat any message that pushes you to “fix” something as hostile by default:
- Assume “Your account needs verification” is a scam until proven otherwise.
- Never use the link in the message (even if it looks right).
- Only take action inside:
- the official app you already have installed, or
- the official website you reach by typing it in yourself.
If it’s real, you’ll see it after you log in normally. If it’s fake, you just avoided the easiest trap in the book.
