A cybersecurity incident at supermarket owner Ahold Delhaize disrupted online grocery orders across five East Coast chains beginning Sunday, Oct. 11, while stores remained open.
Food Lion, Hannaford, Stop & Shop, Giant Food and The GIANT Company still displayed website and app outage notices Tuesday. Customers with unfulfilled orders placed through those channels were promised refunds.
The Netherlands-based company said Tuesday it was beginning “a controlled re-launch of certain systems” after taking some systems offline to protect its network. It did not identify the services being restored.
Supermarket News reported that online grocery deliveries were also suspended. Ahold Delhaize publicly disclosed the network security issue Monday.
Food Lion, Giant Food and The GIANT Company directed shoppers to Instacart, DoorDash and Uber Eats for delivery.
Stop & Shop, Giant Food and The GIANT Company said their stores, pharmacies and fuel stations were open during normal hours. Hannaford said its stores and pharmacies were open. Food Lion asked prescription customers to contact their local pharmacy.
The disruption also reached employee services. BleepingComputer reported that Stop & Shop workers had trouble accessing schedules and pay stubs, citing employee posts.
Chip in once
If this reporting helped you, a one-time tip helps cover hosting, tools and future investigations.
Support us monthly
A small monthly pledge keeps independent coverage and our reader tools online for everyone.
Outside cybersecurity experts were helping investigate, Ahold Delhaize said Tuesday. The company said it was engaging with authorities as needed and had found no evidence at that point that customer or employee data had been taken.
The company faced a separate U.S. network incident in November 2024 that disrupted some pharmacies and e-commerce operations. In an April 2025 update, it said investigators believed files had been taken from internal U.S. business systems during that incident.
Ahold Delhaize has not disclosed the cause of the incident or confirmed ransomware involvement.
