Ahold Delhaize cyberattack: online orders take the hit, again

Ahold Delhaize disconnected part of its network on October 13 after a cyberattack, its second major incident in under two years. The stores stayed open. The online side did not: SecurityWeek reports local media saw deliveries and online orders disrupted at Albert Heijn and Delhaize in the Netherlands and Belgium. When a retailer pulls the plug to contain an attack, e-commerce is usually the first thing that goes dark.

What actually happened

Per SecurityWeek, the Dutch-Belgian grocer identified a security issue on its network and started incident response, which included "taking some systems offline to help protect them." The company said the impact varies by brand, that stores remain open, and that it has notified the relevant authorities. It says it has no evidence that customer or associate data was stolen. It gave no timeline for full restoration.

No group has claimed the attack. SecurityWeek notes it is unclear whether it connects to the refrigeration controller attacks that hit French supermarkets the weekend before. Some Reddit posts suggest US stores were also affected; the company has not confirmed that, so we are not counting it.

The history matters. In November 2024, an attack on Ahold Delhaize's US network hit pharmacies and e-commerce at Stop & Shop, Hannaford, Food Lion, and other brands. INC Ransom later claimed it, and the company told US regulators that data on more than 2.2 million people was compromised.

Why it matters for your business

Read the pattern, not the headline. Twice now, the containment move (take systems offline) kept the stores open and broke the online channel. That is not a failure of the security team. Isolation is the correct call. The failure is that online ordering depends on the same network, identity system, and back-office services as everything else, so it goes down with them.

For a small retailer, the same thing happens on a smaller scale. Your storefront, inventory sync, payment webhooks, and fulfillment app often share one admin account, one email domain, and one integration server. If you have to shut one down, the others go with it.

Three things to decide before the bad day. Which systems can you isolate without killing checkout? What does your storefront show when inventory sync is down: a closed sign, or orders you can't fill? And who calls customers with open orders, using which contact list, if your main system is offline?

Sources: SecurityWeek.