Ahold Delhaize has taken systems offline following a cybersecurity incident at the global retail group. The company confirmed the disruption in a statement describing the event as a cybersecurity incident. Stores remain open.

The retailer, which operates grocery chains across Europe and the United States, did not disclose the nature of the attack. It has not said whether ransomware was involved. No threat actor has claimed responsibility at the time of writing.

What systems went offline?

Ahold Delhaize took affected systems offline as a containment measure. The company has not specified which platforms were disconnected. It has not detailed the impact on supply chain, logistics, or e-commerce operations.

The company said stores remain open. It did not state whether in-store payment, loyalty systems, or online ordering have been affected. Ahold Delhaize has not published a timeline for restoration.

The company operates thousands of stores across multiple brands on two continents. Its banners include major supermarket chains in the Netherlands, Belgium, and the United States. The scale of the group makes containment decisions consequential for day-to-day retail operations.

Why do retailers take systems offline?

Taking systems offline is a standard incident response step. It prevents an intruder from moving laterally (spreading from an initially compromised system to others on the network) while investigators establish the scope of the intrusion.

For a grocery operator, that trade-off carries direct operational cost. Offline systems can disrupt warehouse management, procurement, and replenishment. Retail chains that have suffered similar incidents in recent years have faced empty shelves and delayed deliveries during recovery periods.

Ahold Delhaize has not said whether it engaged external incident response firms. It has not confirmed whether customer or employee data was accessed. The company has not stated whether it has notified data protection regulators, a legal requirement in Europe when personal data breaches occur.

What happens next?

The company will likely face questions on several fronts:

• Whether personal data of customers or staff was compromised, and whether regulators have been informed.
• How long affected systems will remain offline, and which brands or geographies are impacted.
• Whether the incident involves ransomware, and whether any extortion demand has been made.
• What the financial impact will be on operations during the disruption.

European data protection rules require notification of qualifying personal data breaches to regulators within 72 hours of awareness. Ahold Delhaize has not confirmed whether that threshold applies in this case.

Cyberattacks on the retail sector have increased in recent years. Grocery and convenience chains have proven attractive targets because of their thin margins and low tolerance for operational downtime. Attackers calculate that retailers will weigh restoration speed against investigation rigor.

Ahold Delhaize has not named the adversary. It has not attributed the incident to any known group. Security researchers have not yet linked the attack to active ransomware campaigns.

The company said stores remain open. That statement signals the retailer intends to keep trading through the response. It also implies the incident has not disabled point-of-sale infrastructure across the estate, or that workarounds are in place.

Further detail is expected as the investigation proceeds. CIO Monitor will update this story as the company discloses more information.