Ahold Delhaize, the multinational grocery conglomerate that runs US chains Food Lion, Giant Food, Stop & Shop and Dutch retailer Albert Heijn, disclosed on Monday that it deliberately disconnected a range of IT systems as a defensive measure after detecting unauthorized activity within its network.

The company first flagged the intrusion on October 12, stating that security teams had identified "some" IT systems compromised and were working to contain the breach. By the following Monday, Ahold Delhaize confirmed that the breach prompted the proactive shutdown of websites, mobile applications and other digital services across most of its European and US operations.

Frans Muller, president and chief executive officer of Ahold Delhaize, said the precautionary isolation of systems was intended to protect critical infrastructure. "The investigation to date confirms this was the right decision," he said in a public statement.

Physical stores continued to operate normally throughout the incident. The company reported that no evidence indicated that attackers accessed or exfiltrated sensitive customer, employee or partner data. Nevertheless, Ahold Delhaize notified the Dutch National Cyber Security Centre and filed a report with Dutch authorities as part of its standard response protocol.

Digital services have been gradually restored. Albert Heijn’s website and app are back online, with home‑delivery operations slated to resume on Friday. Belgian e‑commerce platforms are fully functional, and the majority of sites and apps serving central and southeastern Europe are operational. The Etos and Gall & Gall brand portals are also back online.

American brand e‑commerce services — covering Food Lion, Giant Food, Martin’s, Hannaford and Stop & Shop — are expected to return to service in the coming days. The company has not yet provided details on whether the breach is linked to a separate series of incidents that affected refrigeration controllers at French supermarkets beginning October 11, incidents that reportedly caused temperatures to rise to 122°F (50°C), spoiling food and igniting fires.

This marks the second cyber‑related disruption for Ahold Delhaize within a two‑year span. A November 2024 intrusion had previously forced Stop & Shop stores to struggle with prescription fulfillment and led to delayed or missing deliveries for Food Lion customers. That earlier attack was claimed by the ransomware group INC Ransom, which leaked documents allegedly taken from the retailer’s systems. In that prior event, Ahold Delhaize later confirmed that personal, financial and health information of more than 2.2 million individuals had been compromised.

The company has not responded to inquiries from The Register regarding any potential connection between the current breach and the French refrigeration controller attacks.