Digital storefronts and mobile applications across major grocery chains including Stop & Shop, Food Lion, Hannaford, and Giant Food remained offline following a network cybersecurity incident at parent company Ahold Delhaize. Physical supermarkets stayed open for shoppers, though the digital outage disrupted loyalty programs and order fulfillment.
Shoppers trying to check digital circulars or place curbside orders across multiple U.S. supermarket chains found themselves locked out of company apps and websites as parent company Ahold Delhaize responded to an internal network security issue. The digital blackout affected digital infrastructure at Stop & Shop, Hannaford, and Giant Food, alongside Food Lion and The GIANT Company. While automated refrigeration, store lighting, and in-store checkout systems continued running normally, the missing digital layer stripped away online shopping portals, mobile coupons, and loyalty account access.
Ahold Delhaize Takes Systems Offline as Precautionary Measure
The disruption began after the Dutch-Belgian retail conglomerate detected suspicious activity within its network. Management initiated a defensive shutdown, disconnecting targeted environments to shield core infrastructure from further interference. Company statements emphasized that the offline measures were deliberate protections rather than accidental crashes.
Our teams are taking steps to assess and mitigate the issue. This includes taking some systems offline to help protect them.
Ahold Delhaize, Corporate Statement
By mid-week, leadership reported that technical crews were launching a controlled restart of selected systems. Even so, the corporation avoided committing to a fixed schedule for complete digital restoration. Executives maintained that no evidence suggested customer or associate data had been compromised in the incident. The Zaandam, Netherlands-based company employs more than 400,000 people and operates over 9,400 stores worldwide, including more than 2,000 U.S. locations.
The network disruption began over the weekend, leading to maintenance messages appearing by Monday and Tuesday. Digital sales at the company’s U.S. operations had risen more than 14% during its most recent quarter, while comparable-store sales grew less than 1%. Because shoppers could not access their accounts via websites or mobile apps, they were cut off from using essential channels to redeem rewards that sit at the heart of the value proposition offered by brands like Giant Food, Hannaford, and Food Lion. This severed key digital links that chains rely on to help customers save money.
National security expert Jack Tomarchio noted that the circumstances raise questions about potential motives behind the incident, pointing out that certain actors frequently target critical infrastructure facilities like energy grids and food sources. He observed that while no ransom demand or personal identifiable information (PII) leak had occurred, incidents of this nature highlight system vulnerabilities and the necessity of hardening digital infrastructure.
Impact on Supermarket Shelves and Online Delivery Orders
The outage forced routine shoppers to adapt quickly inside brick-and-mortar stores. Physical stores, pharmacies, and fuel stations remained open across banners such as Stop & Shop, which serves customers in Connecticut, New York, New Jersey, Massachusetts, and Rhode Island; Food Lion, which operates throughout the Southeast and Mid-Atlantic; Hannaford, serving Maine, New Hampshire, Vermont, Massachusetts, and New York; Giant Food, operating in Maryland, Virginia, Delaware, and Washington, D.C.; and The Giant Company, operating Giant and Martin’s stores primarily in Pennsylvania and neighboring states. Because internal apps were unreachable, grocery banners scrambled to keep shoppers from losing discounts. At Giant Food stores, weekly circular coupons were automatically applied at checkout when customers scanned their store loyalty cards.
Online delivery services fared differently. Direct home delivery through company websites remained suspended, prompting retailers to direct customers toward external platforms. Shoppers needing immediate delivery pivoted to third-party services like DoorDash, Uber Eats, and Instacart. Retailers confirmed that any pre-existing digital orders left unfulfilled would receive automatic financial refunds.
International Scale and Previous Security Breaches
The digital fallout extended far beyond American store banners. In Europe, Dutch subsidiary Albert Heijn experienced severe disruptions across its distribution centers and digital customer service channels, while electronic shelf labels displayed outdated pricing. Subsidiary chains Etos and Gall & Gall were also affected. Albert Heijn began restocking its supermarkets and restarting some IT systems two days after the incident, reporting that several centers were operating and extra deliveries were being laid on, though fresh produce shelves like fruit and vegetables remained partially empty and customer service stayed unreachable.
The incident coincided with a separate cyberattack on hundreds of supermarkets in France over the same weekend, where hackers remotely forced refrigeration systems to defrost to about 50 degrees Celsius (about 122 degrees Fahrenheit) for roughly six hours, causing chains like Intermarché and Coopérative U to throw away fresh and frozen food. An Ahold Delhaize spokesperson told news agency Reuters there was no evidence of a link between the two attacks.
The disruption revives difficult memories for the retailer. In November 2024, a ransomware attack breached Ahold Delhaize systems, ultimately exposing personal information belonging to more than 2.2 million individuals across its U.S. network, including more than 95,000 Mainers—most of whom were current or former employees. That earlier breach disrupted deliveries, payment processing, pharmacies, and online portals, and drew regulatory scrutiny and ongoing concerns regarding corporate cybersecurity resilience.
State and local developments also intersected with the retailer’s operations during the week. In West Hempfield Township, The Giant Company operates Americold’s automated center at 3800 Hempland Road, which has been up for sale and winding down operations. Meanwhile, state officials noted that if the cybersecurity disruption qualified as a reportable data breach under Maine law, it would require notification to the Office of the Maine Attorney General, though neither Hannaford nor Ahold Delhaize had submitted such a report as of mid-week.
