A November 2024 cyberattack disrupted Ahold Delhaize USA pharmacies, online orders and store deliveries. The company later confirmed employment-data theft.
Unauthorized access to systems, accounts, networks, or data.
Data was copied, transferred, downloaded, or otherwise removed from the affected environment by an unauthorized party.
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
Telephone, voice-over-IP, call-center, or related voice communication services were unavailable or materially impaired.
A public-facing website was unavailable, disabled, or inaccessible.
A public, customer, employee, student, patient, vendor, or partner portal was unavailable or materially impaired.
Internal business, administrative, operational, or staff-facing systems were unavailable.
A specific application or software platform became unavailable or unusable.
The organization could not process, receive, issue, reconcile, or record payments normally.
Business, financial, customer, administrative, or operational transactions could not be completed normally.
Staff, customers, patients, students, residents, or other users could not access records or case information normally.
Clinical, diagnostic, pharmacy, patient-care, medical-record, or other healthcare operations were materially affected.
Store, dealership, point-of-sale, inventory, fulfillment, or other retail operations were materially affected.
Procurement, inventory, warehousing, shipping, delivery, vendor, or other supply-chain processes were materially affected.
Services continued but with longer processing, response, delivery, or completion times.
Employees or contractors were unable to perform normal duties because systems, data, facilities, or communications were unavailable.
The incident caused operational effects at customers, affiliates, subsidiaries, partners, tenants, or other dependent organizations.
The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.
The actor published or shared a sample of allegedly stolen victim data to substantiate the extortion claim.
A November 2024 cyberattack disrupted Ahold Delhaize’s U.S. grocery businesses, including pharmacy and online shopping services. The group’s Nov. 8 statement said it took systems offline, engaged outside specialists and notified law enforcement while stores remained open.
Ahold Delhaize USA Services, LLC later confirmed that an unauthorized party obtained files from an internal U.S. repository between Nov. 5 and 6. Its notification letter and public notice distinguish this support-services company from the wider group. The file-taking window does not establish the full period of access or the initial entry date.
Local reporting published Nov. 7 documented prescription-filling failures at Stop & Shop pharmacies beginning Nov. 6. Representatives identified Fairhaven and the Dartmouth Street location in New Bedford; patients needing urgent medication were directed elsewhere. Grocery checkout continued normally at the stores interviewed. The same report documented restricted payment options at Hannaford in Middleboro, where cash and credit cards remained usable.
By Nov. 11, Grocery Dive reported canceled Hannaford pickup and delivery orders because staff could not view them, website and app outages, and phone problems at some pharmacies. Other banners’ online warnings had been removed; that did not establish an exact restoration date for every service. Nov. 20 reporting described continuing inventory shortages and restocking.
A Nov. 23 report quoted Stop & Shop’s Nov. 22 statement that stores were stocked and largely recovered. That is a bounded inventory-recovery milestone. The group’s April 17, 2025 update said stores, business operations and e-commerce services had been restored shortly after the incident and remained operational. That later all-clear supports resolved status, with no precise final restoration day established.
The services company’s June 26, 2025 notice identifies affected current and former employees, dependents, beneficiaries and other people whose information appeared in internal files. Information varied by person and could include contact details, birth dates, government identifiers, financial information, health information in employment records and other employment details. Indiana’s register lists 2,242,521 affected people, including 3,532 Indiana residents; the resident count is part of the reported total.
The company said it had no indication that customer payment or pharmacy systems were compromised. That limited statement does not negate the documented service disruption or employment-file theft.
BleepingComputer reported April 17 that INC Ransom had listed Ahold Delhaize the previous day and posted alleged samples. The company confirmed file theft but did not confirm ransomware involvement in that response. The allegation does not independently establish the operator, encryption or the validity of every alleged sample.
The initial access method, full intrusion interval, exact final restoration date, ransom demand and payment remain unverified. General actor techniques are not established findings about this incident. Nov. 6 is supported as the earliest dated public service impact, while the group’s explicit public cyber acknowledgment came Nov. 8. Nov. 20 remains the latest specifically dated operational impact in the reviewed evidence; positive availability statements and later breach notifications do not extend that timeline.
BleepingComputer reported April 17, 2025 that INC Ransom had listed Ahold Delhaize the previous day and posted alleged document samples. The company’s response confirmed file theft but did not confirm ransomware involvement. The listing remains an unconfirmed attribution claim; encryption, payment, initial access and the validity of every alleged sample are not independently established.
Prince George’s County contains Giant Food’s headquarters at 8301 Professional Place, outside Landover CDP. This corporate location anchors an affected U.S. grocery brand. The group’s disclosure does not establish a headquarters-specific outage or disruption throughout the county.
Contemporaneous reporting identifies a Stop & Shop pharmacy in Fairhaven unable to fill prescriptions during the November 2024 system outage. Grocery checkout continued normally at the locations interviewed. This municipal site link does not establish an outage throughout the municipality or a closure of every store.
Contemporaneous reporting documents restricted payment options at Hannaford’s Middleboro location. Cash and credit cards remained usable; checks and some debit cards could not be accepted. Middleboro is the reported postal name for Middleborough. This is a local store-operation anchor, not a town-wide payment outage.
Contemporaneous reporting identifies a Stop & Shop pharmacy in New Bedford unable to fill prescriptions during the November 2024 system outage. Grocery checkout continued normally at the locations interviewed. This municipal site link does not establish an outage throughout the municipality or a closure of every store.
Quincy is a standing U.S. corporate location associated with Ahold Delhaize and Stop & Shop. This is a physical corporate anchor for the affected U.S. businesses, not the Netherlands parent’s headquarters. The reviewed evidence does not establish an office closure or an outage throughout Quincy.
The directly affected U.S. services company’s principal office is at 2110 Executive Drive, within incorporated Salisbury city in Rowan County. This administrative physical anchor does not establish which building hosted compromised files, an office closure or an outage throughout Salisbury.
Middlesex Township contains The GIANT Company’s headquarters at 1149 Harrisburg Pike, a corporate location of an affected U.S. grocery brand. The group’s disclosure supports the brand’s involvement; it does not establish a headquarters-specific outage or disruption across the township.
We reported disruption to Ahold Delhaize’s U.S. grocery brands, including pharmacy and online services. Our reporting described the protective shutdown while stores remained open.
Local pharmacy representatives reported prescription-filling failures beginning Nov. 6, with urgent prescriptions directed elsewhere. The report also described restricted payment options at Hannaford in Middleboro while grocery checkout at the interviewed Stop & Shop stores continued normally.
Ahold Delhaize said a cybersecurity issue and protective system shutdowns affected some U.S. pharmacies and e-commerce operations. Stores remained open while the company investigated with outside specialists and notified law enforcement.
Grocery Dive reported that Hannaford canceled pickup and delivery orders because staff could not view them, while its website and app remained unavailable. Some pharmacy phone service was affected, and other grocery banners had removed earlier online outage warnings.
Boston.com reported continuing inventory shortages and restocking at Stop & Shop and Hannaford on Nov. 20. Stop & Shop said availability would improve over the following days.
The Nov. 23 report quoted Stop & Shop’s Nov. 22 statement that stores were stocked and largely recovered. The company said it was ready for Thanksgiving shoppers.
BleepingComputer reported that INC Ransom had listed Ahold Delhaize April 16, 2025, and posted alleged document samples. A company spokesperson confirmed file theft without confirming ransomware involvement.
Ahold Delhaize said stores, business operations and e-commerce services had been restored shortly after the November incident and remained operational. It also said it believed files had been taken from internal U.S. systems.
The company said it detected unauthorized access Nov. 6, 2024, and that files were obtained between Nov. 5 and 6. Its notice identifies employees, dependents, beneficiaries and others whose employment-related information varied by person.
The services company’s June 26, 2025 letter says an unauthorized party obtained files from an internal U.S. repository between Nov. 5 and 6, 2024. Employment-related information varied by affected person, and the company offered two years of identity-protection services.
Indiana’s register lists 2,242,521 people affected by the services-company incident, including 3,532 Indiana residents. It records notification June 26, 2025, and a Nov. 5, 2024 breach date.
Ahold Delhaize identifies Giant Food’s headquarters as 8301 Professional Place, Suite 115, Landover, Maryland. The mailing address does not establish that the office lies within Landover’s census-designated boundary.
Ahold Delhaize identifies The GIANT Company’s headquarters as 1149 Harrisburg Pike, Carlisle, Pennsylvania. The postal city does not establish that the office lies within Carlisle borough.
The address match places 2110 Executive Drive in incorporated Salisbury, Rowan County, North Carolina. This is the services company’s principal-office address.
The address match places 8301 Professional Place in Prince George’s County, Maryland, without identifying an incorporated municipality. Landover is the mailing city.
The address match places 1149 Harrisburg Pike in Middlesex Township, Cumberland County, Pennsylvania. Carlisle is the mailing city.
Signed-in members can report an error, update, or missing source.
