Skip to content
DysruptionHub
Sign in Subscribe

Ahold Delhaize USA cyberattack disrupts grocery services

Summary

Ahold Delhaize USA Services, LLC logo

A November 2024 cyberattack disrupted Ahold Delhaize USA pharmacies, online orders and store deliveries. The company later confirmed employment-data theft.

Key facts

Timeline

  • Incident start:
    ? Earliest known or assessed start of malicious activity or incident activity.
  • First public signal:
    ? Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity.
  • First public cyber evidence:
    ? Earliest credible public information connecting the incident or disruption to malicious cyber activity.
  • Official cyber disclosure:
    ? First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related.
  • Last impact seen:
    ? Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.

Primary victim organization

Impacted locations

Organization types

Critical infrastructure sector

DysruptionHub coverage

Incident characteristics

Assessments

Cyber assessment:
Confirmed
Status:
Resolved
Incident confidence:
High
Ransomware:
Low
Attribution:
Low

Attack mechanisms

Data impacts

  • Data theft or exfiltration

    Data was copied, transferred, downloaded, or otherwise removed from the affected environment by an unauthorized party.

  • Data unavailable

    Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.

Operational impacts

  • Phone service disruption

    Telephone, voice-over-IP, call-center, or related voice communication services were unavailable or materially impaired.

  • Website unavailable

    A public-facing website was unavailable, disabled, or inaccessible.

  • Online portal unavailable

    A public, customer, employee, student, patient, vendor, or partner portal was unavailable or materially impaired.

  • Internal systems unavailable

    Internal business, administrative, operational, or staff-facing systems were unavailable.

  • Application unavailable

    A specific application or software platform became unavailable or unusable.

  • Payment processing disruption

    The organization could not process, receive, issue, reconcile, or record payments normally.

  • Transaction processing disruption

    Business, financial, customer, administrative, or operational transactions could not be completed normally.

  • Records access disruption

    Staff, customers, patients, students, residents, or other users could not access records or case information normally.

  • Healthcare operations disrupted

    Clinical, diagnostic, pharmacy, patient-care, medical-record, or other healthcare operations were materially affected.

  • Retail operations disrupted

    Store, dealership, point-of-sale, inventory, fulfillment, or other retail operations were materially affected.

  • Supply chain disruption

    Procurement, inventory, warehousing, shipping, delivery, vendor, or other supply-chain processes were materially affected.

  • Service delay

    Services continued but with longer processing, response, delivery, or completion times.

  • Staff unable to work normally

    Employees or contractors were unable to perform normal duties because systems, data, facilities, or communications were unavailable.

  • Downstream organization impact

    The incident caused operational effects at customers, affiliates, subsidiaries, partners, tenants, or other dependent organizations.

Extortion indicators

  • Leak-site listing

    The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.

  • Data sample published

    The actor published or shared a sample of allegedly stolen victim data to substantiate the extortion claim.

Incident narrative

Grocery and pharmacy services disrupted

Ahold Delhaize USA detected unauthorized access to internal U.S. systems on Nov. 6, 2024. Its later notification letter establishes that an unauthorized party obtained files from a U.S. repository between Nov. 5 and 6. That window does not establish the entire period of access.

The group’s Nov. 8 statement said it took systems offline, engaged outside specialists and notified law enforcement. Some pharmacies and online grocery services were affected, while stores remained open.

Local reporting on Nov. 7 documented prescription-filling failures at Stop & Shop pharmacies beginning the previous afternoon. Staff directed people needing urgent medication to other pharmacies. A Hannaford location accepted some payment types while restricting others; that did not establish a universal inability to take payments.

By Nov. 11, Grocery Dive reported canceled Hannaford pickup and delivery orders because staff could not view them, continuing website and app outages, and phone problems at some pharmacies. Other banners’ online warnings had been removed. A Nov. 20 report described continuing inventory shortages and restocking work. A forecast of improvement was not a confirmed completion date.

Recovery and employment-data breach

In an April 17, 2025, update, Ahold Delhaize said stores, business operations and e-commerce services had been restored shortly after the incident and remained operational. This supports resolved status, without establishing an exact final restoration date. Nov. 20 remains the latest specifically dated operational impact established in the reviewed evidence.

Ahold Delhaize USA Services’ June 26 notice describes affected current and former employees, dependents, beneficiaries and other people whose information appeared in internal files. Information varied by person and could include contact details, birth dates, government identifiers, financial information, health information in employment records and other employment details. Indiana’s breach register reports 2,242,521 affected people, including 3,532 Indiana residents.

The services company said it had no indication that customer payment or pharmacy systems were compromised. That limited assurance concerns compromise of those systems; it does not negate the documented service disruption or employment-data theft.

Attribution and remaining uncertainty

BleepingComputer reported April 17 that INC Ransom had listed Ahold Delhaize the previous day and posted alleged document samples. The company confirmed file theft but did not confirm ransomware involvement in that response. The allegation does not independently establish the operator, encryption, a ransom demand or payment.

The initial access method and exact final restoration date remain unverified. The separate October 2026 Ahold Delhaize incident is outside this record.

Threat actor and claim

INC Ransom

Listed as: Ahold DelhaizeSource: BleepingComputerDiscovered:

Claim details

BleepingComputer reported April17,2025 that INC Ransom had listed Ahold Delhaize the previous day and posted alleged document samples. April17 is the dated reporting observation; exact original actor publication time is not verified here. The company’s response confirmed file theft but declined to confirm ransomware involvement. This is an unconfirmed operator claim: it does not prove encryption, a payment, initial access method or validity of every alleged sample. LiveMCPcanonicalname/domain/USAname searches returnedzero, which does not erase this accessible reportedclaim. Preserve the independently researched canonicalINCactor and its sources.

Organizations involved

Impacted locations

  • Quincy, Massachusetts

    Unresolved Confidence

    Retain the existing Quincyrelationship pending exact U.S.corporate-office/entity reconciliation. Quincy is a standing U.S.corporateanchor associated with the group and StopShop, not the foreignultimateparent’s headquarters or a demonstrated municipalitywideoutage. The 2024incident affected U.S.systems and retailservices; precise Quincyfacility-specificeffects and area scope are not established.

  • Salisbury, North Carolina

    Medium Confidence

    Salisbury is the principal-office mailing city for the directly affected U.S.servicesLLC according to RIentity001669300,2110ExecutiveDrive. This links the affected operator to its administrativephysicalanchor; source does not establish which building hosted compromisedfiles, a localofficeclosure or a citywideoutage. Exactincorporatedcontainment remains bounded, not inferred from postal label.

    Source

Sources

Published Last updated

See something that needs correction?

Signed-in members can report an error, update, or missing source.