Food Lion, Stop & Shop sites back online after Ahold Delhaize cyberattack

Food Lion, Stop & Shop, Hannaford and the other US grocery chains owned by Ahold Delhaize brought their websites and apps back online by Tuesday, October 20, 2026, more than a week after a cyberattack forced the Dutch-Belgian group to take systems offline in the United States and Europe. The company has said the trouble was caused by "the malicious actions of others", but it has not said what kind of attack it was or whether a ransom was demanded. It says it has found no evidence so far that sensitive customer, employee or partner data was stolen, and its investigation is continuing.

Groceries are an everyday necessity, and in the United States more and more shoppers order them through apps and websites for delivery or kerbside pickup. When a chain like Food Lion, which the trend searches show many people were checking, goes dark online for a week, customers cannot place orders, check loyalty rewards or see weekly offers, even though the shelves are stocked. The episode shows how dependent retail has become on digital systems, and how a single attack on a parent company can hit several brands at once.

The company's decision to take systems offline "as a precaution" is a common response to cyberattacks. When security teams find intruders, switching off systems can stop the attack spreading, protect data and give investigators time to work, but it also causes the outages customers notice. The length of this outage, more than a week for online services, suggests the company was cautious about bringing systems back before it was sure they were clean.

What is not known matters too. Ahold Delhaize has not said whether it was hit by ransomware, a type of attack in which criminals lock or steal data and demand payment, nor whether a ransom was paid. Reports note that the company has not confirmed any link between its incident and separate attacks on refrigeration controllers in French supermarkets. Its statement that there is no evidence so far of sensitive data theft is reassuring but provisional; such findings often change as investigations go on.

For Indian readers, the case is relevant as quick-commerce and online grocery services grow fast in Indian cities. The same lessons apply: retailers need backup systems that let stores keep selling during an attack, clear and timely updates for customers, and plans to restore services safely. Under India's Digital Personal Data Protection Act, companies that lose personal data must also inform the authorities and affected people.

Short-term: US shoppers can again order online and use loyalty features, though some services may take longer to return fully. Customers should watch for official messages from their store and be wary of emails or texts that use the incident to ask for passwords or payment details.

Long-term: A second major incident in about two years will put pressure on Ahold Delhaize to show investors, regulators and customers what it is changing in its security. If the investigation finds that data was taken, the company could face notification duties, legal claims and regulatory scrutiny.

Who is affected: shoppers of Food Lion, Stop & Shop, Hannaford, Giant and other Ahold Delhaize brands; the group's employees and suppliers; its shareholders; and other retailers studying how to prepare for similar attacks.

Questions and Answers