A ransomware crew knocked Ahold Delhaize's US grocery systems offline for days

On 8 November 2024 Ahold Delhaize USA — parent of Stop & Shop, Hannaford, Food Lion, Giant Food and The Giant Company, more than 2,000 stores — disclosed a cyberattack and took systems offline to contain it. Pickup and delivery orders were canceled because associates could not view what had been ordered; some pharmacies could not take calls; the Hannaford website and app stayed down into a second week. Stores remained open and kept taking cards, but the disruption landed right before the US holiday sales run-up.

Weeks later the company confirmed files had been stolen, after a group tracked as Inc Ransom claimed on its leak site to hold up to 6 TB of data from the US division, according to Arctic Wolf researchers. Per later state filings, the intruders had already reached one of its databases on 5-6 November, days before the public disclosure. The shake-up around the incident was awkward: the US business had just onboarded a new CIO, Ann Dozier, after two years of IT-leadership changes.

In 2025 the full bill appeared. Maine's attorney general filing put the exposure at about 2.2 million people — current and former employees, dependents and beneficiaries, including roughly 100,000 Mainers — with birthdays, Social Security numbers, bank details, health records and workers' compensation data. The company said it did not believe customer payment or pharmacy systems were hit: containment protected shoppers' cards, while the stolen data was mostly about the workforce.

Days of canceled pickup/delivery and downed pharmacy systems across 2,000+ stores; up to 6 TB claimed stolen; records of 2.2M people exposed.

The intrusion ran for days before detection — attackers reached a personnel database on 5-6 November, ahead of the 8 November disclosure.

Containment meant pulling the plug on e-commerce and parts of pharmacy, trading revenue and customer trust for safety with no pre-built degraded mode.

Recovery leaned on manual workarounds, so cancellations and customer communication lagged and pending charges lingered on bank accounts.

Recent IT-leadership churn left ownership of legacy access controls unsettled at the worst possible moment.

Preemptive shutdown contains an attack but converts it into a visible service outage: resilience planning has to budget for how customers experience the containment, not just the breach.

All US stores stayed open through the disruption, and Hannaford's site and app were still down early the following week. In December 2024 Ahold Delhaize confirmed data was stolen after Inc Ransom threatened to publish it; law enforcement was notified and outside forensics engaged. Through 2025 the company notified about 2.2 million current and former employees and their families, and said it had found no sign that customer payment or pharmacy systems were compromised — the containment held where it mattered, at the cost of a very public service outage.