The Grocery Giant That Got Hit Twice: Why “Stores Are Open” Isn’t the Same as “We’re Fine”

The headline from Ahold Delhaize this month was a reassuring one: our stores are open and serving customers. True, and also beside the point. Behind that sentence, the company that runs Food Lion, Stop & Shop, Giant Food, Hannaford, and Albert Heijn had taken major parts of its digital operation offline across two continents.

Executives should read this story as a lesson in what “resilient” actually means, and in how much a board should ask after the first incident.

What happened

Ahold Delhaize, one of the world’s largest grocery operators, said on Monday, October 12, 2026 that it was experiencing “a security issue within its network” and had taken some systems offline. Reporting from SupermarketNews indicates the incident began the day before, on Sunday. Websites for U.S. banners including Food Lion, Hannaford, Stop & Shop, and Giant Food went dark, and online grocery ordering and deliveries were suspended. In Europe, Albert Heijn, Delhaize, Etos, Gall & Gall, and bol.com were affected. BleepingComputer reported that a Food Lion internal memo warned a store “may be unable to shop, stage, or hand off orders,” and that Stop & Shop employees reported trouble reaching schedules and pay stubs.

A week later, on October 19, the company went further. CEO Frans Muller said the issue was caused by the “malicious actions of others,” and that taking systems offline was “a precautionary measure” that the investigation to date confirmed “was the right decision,” according to The Register. Recovery has been staged: Albert Heijn’s website and app are back and Belgian e-commerce is fully operational, while U.S. e-commerce was expected back “in the coming days.”

What the company has not said is equally important. As of the latest reporting, it has found no evidence that sensitive customer, associate, or partner data was stolen, and no group has publicly claimed the attack. Those are early findings, not conclusions. Investigations frequently change in their second and third weeks.

The detail that should make a board lean forward

This is not Ahold Delhaize’s first major incident. In November 2024, attackers broke into its U.S. business systems. The company later reported that data on 2,242,521 people was affected, including names, government ID numbers, bank account information, and some employment-related health information, according to BleepingComputer’s reporting on the company’s state filing. The INC Ransom group listed the company on its leak site; the company has not confirmed that group was responsible.

Two significant incidents in under two years doesn’t automatically mean negligence. Large retailers are large targets. But it changes the question a board should ask. After the first incident, the question is “did we fix what happened?” After the second, it is “did we fix the conditions that allowed it?”

Why this matters beyond grocery

Operational resilience is a business metric, not an IT metric. Ahold’s stores stayed open, which is a genuine achievement and a sign that some planning worked. But the same reporting describes suspended online ordering, deliveries, loyalty discounts, and the possibility that electronic shelf labels showed outdated prices. A business can be “open” and still losing revenue, trust, and margin by the hour.

Shutting everything down is a decision someone has to be authorized to make. Muller called pulling systems offline a precautionary measure. That is a hard call at a company serving tens of millions of customers weekly. Does your company know who can make it, how fast, and what it will cost per day? Most boards have never asked.

Compliance won’t tell you this. This is the compliance-versus-security gap I write about in Cyber Risk Is Business Risk. A company can pass its audits and still discover, in the middle of an incident, that its recovery sequence has never been rehearsed end to end.

Apply the Three Questions

The book’s framework asks of any risk: What are we protecting? How would we know if it failed? What would it cost us if it did?

What are we protecting? Customer data, yes — but more critically, the ability to sell. For a retailer, ordering, pricing, scheduling, and payroll systems are the business.

How would we know? Ahold detected the problem and acted within a day. Ask your own team how long the gap would be for you, and who decides when a “security issue” becomes an “all systems offline” decision.

What would it cost us? Calculate a number for one week without your digital channels. If nobody can produce it, that is the first finding.

What to ask your CISO this week

1. If we had to take our customer-facing systems offline tomorrow, who has the authority to decide, and have we rehearsed it?
2. What is our estimated cost per day of a partial outage, and does the board know that number?
3. After our last incident (or a peer’s), what specifically changed, and how do we know the fix addressed the root cause rather than the symptom?
4. Which systems must come back first, in what order, and has that sequence been tested with the business, not just IT?
5. If employees can’t reach schedules or pay stubs, what is the plan to keep the workforce informed and paid?

The bottom line

Boards tend to ask about the breach. The harder and more useful question is about the recovery: how much of the business keeps running when the digital layer doesn’t. Ahold Delhaize looks, so far, like a company that made a fast, defensible call. The lesson for everyone else is to decide, before the incident, what that call will be.