Ahold Delhaize, one of the world's largest grocery groups, has disconnected a range of its systems in response to a cyberattack. The company disclosed the incident after deciding that pulling infrastructure offline was the safest way to contain the damage while its security teams investigated.

The decision is a classic playbook move — but it's never a small one. When a retailer the size of Ahold Delhaize severs connections between systems, the immediate cost isn't measured in incident-response invoices alone. It's measured in disrupted logistics, delayed store replenishment, and IT staff working around the clock to rebuild trusted connections one by one.

What does this change for enterprise security teams?

For CISOs watching from other large retailers, the story is a reminder that incident response plans need a disconnect option that operations can actually survive. Isolation stops the spread of malware or ransomware across a network. It also stops the business — at least partially, and at least for a while.

Ahold Delhaize's choice suggests the company judged the risk of leaving systems interconnected as greater than the cost of taking them down. That calculation is different for every enterprise, but the trigger is usually the same: evidence that an attacker is moving laterally, or could.

Why grocers are a prime target

Food retail sits in an awkward spot for security teams. Stores run around the clock. Margins are thin. Supply chains depend on tightly integrated ordering and logistics systems that span suppliers, distribution centers, and thousands of points of sale.

That integration is exactly what makes the sector attractive to attackers. A single foothold in a connected environment can ripple outward fast — which is why severing connections, painful as it is, often becomes the containment step of first resort.

Ahold Delhaize operates major supermarket brands across Europe and the United States, serving millions of customers weekly through thousands of stores. At that scale, even a partial system disconnection touches everything from payroll pipelines to supplier ordering platforms.

The pattern behind the incident

The grocery giant is far from alone. Retail and food distribution have absorbed a steady run of high-impact intrusions in recent years, with attackers favoring sectors where downtime translates directly into lost revenue — and into pressure to pay.

Security teams at comparable organizations typically respond with the same sequence Ahold Delhaize appears to be following:

• Detect the intrusion and assess its scope
• Disconnect affected systems to block lateral movement
• Investigate with internal and external forensic support
• Restore services in a prioritized, verified order

What happens next

The company has not yet detailed the nature of the attack, the systems affected, or the timeline for full restoration. Those details will shape how the incident is ultimately judged — as a contained disruption or something more costly.

For now, the hardest fact stands on its own: Ahold Delhaize chose to switch things off rather than risk letting an attacker keep moving.