Food Lion was among the Ahold Delhaize brands returning online after the company said on October 19, 2026 that it was restoring websites, apps and other services following a cybersecurity incident detected on Monday, October 12, 2026. Frans Muller said the shutdown was precautionary and apologized for the inconvenience to customers.
He said, "Taking systems offline to help protect them was a precautionary measure that affected most of our brands across Europe and the United States." Muller also said, "Although this incident was caused by the malicious actions of others, we apologize for the inconvenience this has caused - especially to our customers."
Ahold Delhaize October 19 update
Ahold Delhaize said Albert Heijn’s website and app were back online by October 19, while Albert Heijn home deliveries were expected to resume from Friday, October 23. The Etos and Gall & Gall websites were available for customers the same day, and e-commerce services at Ahold Delhaize USA brands were expected to come back in the coming days.
In Belgium, e-commerce was fully operational on October 19. The majority of the websites and apps of Ahold Delhaize brands in Central and Southeastern Europe were also available for customers.
Dutch National Cyber Security Centre
Ahold Delhaize said it detected suspicious activity in its IT infrastructure and brought in cybersecurity experts to investigate. The company notified the Dutch National Cyber Security Centre within 24 hours of discovering the malicious activity and continued to provide updates to the Dutch National Cyber Security Centre, law enforcement and other relevant regulatory authorities.
The company also filed a formal police report with the Dutch police on October 19, 2026. Its brands’ stores remained open throughout the incident while systems came back in phases.
Customer data review
Ahold Delhaize said it had no evidence at that moment that any sensitive customer, associate or partner data was taken, while the investigation was still ongoing. The update left one basic question open: what specific method was used in the malicious activity that led to the outage.
