Ahold Delhaize Takes Systems Offline After Security Issue

Ahold Delhaize disconnected some systems after finding a security issue in its network, the Dutch-Belgian grocery group said in a notice on its website. Its stores remain open, and the company reported no impact on its ability to serve customers.

The company’s teams are assessing the incident and working to limit its effects. Disconnecting systems from the network was a protective measure, according to the notice.

“Protecting our infrastructure in the best interest of our customers, associates, and partners is a top priority,” Ahold Delhaize wrote. The company apologized for inconvenience affecting customers and business partners.

Ahold Delhaize did not disclose the type of security issue, which systems were affected or whether data had been accessed. It also did not say whether the incident involved ransomware or when all systems would be restored.

Reports indicated that deliveries and online orders at Albert Heijn and Delhaize were affected in the Netherlands and Belgium. Some operations in the United States also appeared to have been disrupted.

The incident came after a separate cyberattack affected refrigeration equipment at hundreds of supermarkets in Europe. The attack reportedly caused refrigerators and freezers to heat up overnight, damaging food at stores in France, Belgium, Germany, the Netherlands, Poland, Portugal and Spain.

More than 300 supermarket locations in France were reportedly affected. The chains included Auchan, Carrefour, E.Leclerc, Intermarché and Monoprix. Groupe Casino, which owns Monoprix, reported that about 5% of Monoprix stores were affected and that no other brands in its group had been impacted.

The attackers reportedly accessed refrigeration controllers made by Danish company Danfoss and changed freezer and refrigerator settings remotely. Some equipment reached 50 degrees Celsius, or 122 degrees Fahrenheit, for about six hours before employees found the problem. Affected stores removed products when storage conditions could not be confirmed.

The attack followed Claroty’s disclosure of vulnerabilities in Danfoss’ AK-SM 800A refrigeration management platform. The cybersecurity company reported that the flaws could allow attackers to bypass authentication, run code remotely and change system settings. Claroty identified thousands of publicly accessible management interfaces and advised users to install firmware version R4.3.1. There is no confirmation that the vulnerabilities were used against Ahold Delhaize.

Ahold Delhaize experienced another cyber incident in November 2024 that affected systems connected to Giant Food pharmacies, Hannaford supermarkets, Food Lion, The Giant Company and Stop & Shop in the United States. In April 2025, the company confirmed that data had been stolen after the INC Ransom group claimed responsibility. In June 2025, Ahold Delhaize notified U.S. regulators that personal information belonging to more than 2.2 million people had been compromised. The company has not confirmed a connection between that incident, the current security issue and the refrigeration attack.