AMSTERDAM, October 16, 2026 — Ahold Delhaize, one of the world’s largest grocery retailers, continued struggling to restore digital services on Friday as a cybersecurity incident entered its fifth day of widespread operational disruption, affecting supermarket websites, mobile applications, online grocery deliveries, and related customer services.

The Netherlands-based company has taken portions of its information technology network offline as a precaution while investigating the incident. The disruption has affected several businesses within its international retail portfolio, underscoring the dependence of modern supermarket operations on digital systems that connect customers, distribution centers, employees, and suppliers.

Reuters reported Friday that websites and online delivery services at grocery chains belonging to Ahold Delhaize remained unavailable five days after the disruption began. The group has characterized the situation as a cybersecurity incident rather than publicly confirming a particular form of cyberattack, and it has not identified the cause or disclosed details about any suspected perpetrators.

The most significant new development came from Albert Heijn, the company’s flagship Dutch supermarket chain, which extended the suspension of online grocery deliveries beyond its earlier timetable. In an October 16 update issued at 5:15 p.m. Amsterdam time, Albert Heijn confirmed that all previously scheduled online grocery deliveries through at least Tuesday, October 20, had been canceled.

The retailer said customers still could not place new online orders and that it was working to resume home deliveries during the second half of the following week. Customers who had already paid for canceled orders would receive compensation once the company’s systems became operational again, according to the statement. The revised timetable represented a deterioration from the previous day’s guidance, which had ruled out deliveries through October 18.

The extended suspension demonstrates the difference between restoring conventional supermarket distribution and fully recovering digital commerce operations. While the company has made substantial progress replenishing stores, its online fulfillment systems remain unavailable, preventing customers from using a service that has become an increasingly important component of grocery retail competition.

The cybersecurity incident began affecting Albert Heijn, Etos, and Gall & Gall on the afternoon of Sunday, October 11. Ahold Delhaize publicly acknowledged a network security issue on October 12, explaining that certain systems had been deliberately disconnected to protect the wider infrastructure while specialists investigated the problem.

In its October 13 statement, subsequently updated October 14, Ahold Delhaize said its internal teams were working alongside external cybersecurity experts to assess the incident and restore affected systems. The company also reported that it had begun a controlled restart of selected technology services, indicating that recovery would proceed gradually rather than through the immediate reconnection of all affected applications.

Such a controlled restoration process is important because modern grocery operations depend on several connected technology functions. Online ordering systems must communicate with payment processing, customer accounts, product availability databases, warehouse management applications, delivery scheduling tools, and customer service platforms. Restoring one component does not necessarily make the complete service operational.

For Albert Heijn, the incident initially disrupted distribution centers and affected the availability of fresh products, including vegetables and fruit. Some supermarkets experienced reduced stock levels even as stores remained open and continued processing transactions.

The retailer’s recovery accelerated during the middle of the week. On October 14, Albert Heijn reported that its distribution centers had become operational again, with regular deliveries of shelf-stable products restored and fresh-food deliveries restarting. By October 15, the company said regular deliveries of both fresh and nonperishable goods had resumed nationwide.

Its latest October 16 statement indicated that stores were receiving replenishment multiple times daily and that shelves across the Netherlands were again stocked with a broad assortment of groceries. The improvement suggests that the company’s immediate physical supply constraints had eased substantially, even though customer-facing online services were still experiencing significant interruption.

Supermarkets have remained open throughout the incident, and checkout systems have continued functioning. However, the temporary loss of several digital services has complicated routine shopping activities. Albert Heijn reported interruptions affecting personalized discounts, loyalty savings, rewards programs, and customer service functions linked to its applications.

The retailer said nationwide Bonus promotional discounts continued to be applied at checkout, while certain personalized offers and savings services remained unavailable. Its digital shelf labels had also been restored to display regular prices correctly. Customers were encouraged to retain receipts for transactions involving temporarily unavailable loyalty benefits, including Koopzegels savings and selected AH Premium discounts.

These customer-facing limitations illustrate how digital infrastructure failures can affect retail transactions even when core payment systems remain operational. Loyalty applications and personalized promotions increasingly influence consumer purchasing behavior, making their availability relevant to both customer satisfaction and promotional effectiveness.

The implications extend beyond the Dutch market. Ahold Delhaize operates an extensive network of grocery brands in the United States, including Stop & Shop, Giant Food, Hannaford, and Food Lion. Some of those businesses have also experienced interruptions to websites, applications, and other digital services following the parent company’s precautionary shutdown.

Reports from U.S. markets indicated that Hannaford customers had experienced problems accessing online features, including digital coupons, rewards functions, and grocery ordering services. Stop & Shop also faced website and application disruption. Ahold Delhaize has emphasized that stores across its American and European operations remain open, while the operational impact differs among individual brands.

The company has not published a comprehensive breakdown of the number of affected customers, canceled transactions, or individual business systems across its international network. Consequently, the financial scale of the disruption remains difficult to assess, particularly because the effects on online retail activity and physical-store operations have differed significantly.

The issue is nevertheless material to Ahold Delhaize’s broader commercial strategy. According to its 2025 annual report, the group generated approximately €92.4 billion in annual net sales, with online sales reaching €10.3 billion. The company reported double-digit growth in its e-commerce businesses and emphasized the importance of integrated physical and digital shopping experiences.

Online sales rose 13.3% at constant exchange rates in 2025, reflecting the group’s investment in digital ordering capabilities, delivery partnerships, loyalty systems, and e-commerce technology. The reported online total includes multiple businesses and product categories, however, and cannot be used to calculate the daily revenue lost from the current grocery service disruption.

The latest incident therefore arrives at a time when the retailer has increasingly positioned digital commerce as a contributor to growth and competitive differentiation. Interruptions to those services may produce several financial effects, including canceled orders, lower customer activity, incremental operating expenses, and possible shifts in purchasing toward competing retailers.

Some lost online transactions could eventually be recovered when systems are restored. Other sales may move to physical stores or rival grocery providers. Without company-level disclosure of canceled order values, substitution behavior, recovery costs, and the duration of individual outages, it is not possible to establish the net effect on revenue or operating profit.

Cybersecurity response costs represent another potential consideration. A prolonged incident can require external technical specialists, forensic investigation, infrastructure restoration, additional employee resources, legal advice, and enhanced monitoring. Companies may also incur customer compensation expenses and logistical inefficiencies during the recovery period. Ahold Delhaize has not quantified such costs in connection with the October 2026 event.

Investor attention is also likely to focus on whether the incident reveals weaknesses in the resilience of systems shared across the group’s different retail businesses. The company’s decentralized brand structure allows local operators to serve their respective markets, but shared technology and support functions can create dependencies that become significant during network security emergencies.

The current disruption demonstrates that a multinational retailer can maintain physical operations while losing access to important digital channels. Such partial outages may reduce the likelihood of a complete commercial shutdown but can still damage service quality, interrupt inventory coordination, and create uncertainty for customers and employees.

The incident has also drawn attention from Dutch authorities. Reuters reported Friday that Justice Minister David van Weel had urged Ahold Delhaize to file a criminal complaint concerning the cybersecurity disruption. His remarks followed discussions about the role of law enforcement in investigating incidents that affect major commercial organizations.

Van Weel acknowledged that companies confronting an immediate cybersecurity emergency may initially concentrate on preventing further damage to their infrastructure. He nevertheless argued that the company should take the next step toward involving criminal investigators more formally as the immediate situation stabilized.

In a public statement dated October 14, Dutch police said they and the Public Prosecution Service had been in contact with Ahold Delhaize and had invited the company to report the incident. The authorities emphasized that rapid access to technical information from affected organizations can support the identification and prosecution of cybercriminals.

The police statement also distinguished cybersecurity reporting obligations from the filing of a criminal complaint. It said Ahold Delhaize had complied with the applicable reporting requirement under the cybersecurity framework, while the absence of a formal criminal investigation at the time of the statement remained a separate matter.

For large companies, the distinction is consequential. Regulatory or cybersecurity notifications can help authorities assess systemic risk and share technical intelligence, while criminal complaints may provide investigators with a separate route to pursue suspected offenders. The October 16 developments put additional attention on cooperation between the retailer and Dutch enforcement agencies.

Ahold Delhaize has provided limited information about the technical nature of the incident. The company has not publicly established whether the disruption involved ransomware, stolen credentials, malicious software, unauthorized system access, or another security problem. It has also not disclosed a confirmed point of entry or a detailed sequence of events preceding the network shutdown.

The company said it was withholding further investigative information to avoid compromising security measures or interfering with its response. That position leaves substantial questions unanswered, including which systems were directly affected by the original security issue and which became unavailable primarily because of the company’s precautionary containment decisions.

On the question of personal information, Ahold Delhaize’s October 14 statement reported no evidence that customer, associate, or partner data had been taken. Albert Heijn repeated on October 16 that its investigation had found no indications so far that personal data was involved. These statements are preliminary findings rather than a definitive conclusion that no information was accessed or exposed.

The distinction matters because Ahold Delhaize previously experienced a separate cybersecurity incident affecting its U.S. operations in November 2024. Subsequent company disclosures confirmed that an unauthorized party had obtained certain files from internal American business systems, including information affecting employees. The earlier event is distinct from the October 2026 disruption, and no evidence has been publicly established linking the two incidents.

That history nevertheless provides context for investor scrutiny of the company’s cybersecurity investments and operational controls. Ahold Delhaize’s 2025 annual report described measures involving endpoint protection, threat intelligence, employee training, and oversight of external service providers. The company also outlined continuing work to strengthen its cybersecurity framework in response to a changing threat environment.

One operational lesson emerging from the current incident is the importance of recovery sequencing. The group has been able to restore warehouse activity and store replenishment before resuming online delivery services. This suggests that distinct technology functions may be restarted at different stages, depending on their security requirements and the dependencies between operational systems.

For consumers, however, a partial recovery does not eliminate the inconvenience. Online grocery customers may rely on scheduled deliveries because of work, mobility limitations, or household planning requirements. Repeated cancellations can force shoppers to arrange alternative purchases, while the continued suspension of new orders may affect customers who ordinarily shop through digital channels.

Customer communication is another critical element. Albert Heijn has used its public news website, social media channels, and in-store notices to communicate service interruptions and restoration progress. It has also warned customers that criminals may exploit cybersecurity incidents through phishing attempts that impersonate legitimate organizations or employees.

Such warnings are particularly relevant when customers are expecting information about canceled orders or compensation. The company’s inability to provide normal customer service through some affected channels increases the importance of distinguishing authorized updates from potentially fraudulent communications.

From a competitive standpoint, the duration of the online grocery suspension could influence consumer behavior if customers establish alternative shopping arrangements. Although supermarket customer loyalty is often supported by geographic convenience, pricing, and product selection, online shopping depends heavily on reliability, available delivery slots, and the consistency of digital ordering experiences.

At the same time, Albert Heijn’s successful restoration of distribution operations reduces one of the immediate risks to its core retail business. The company can continue selling products through physical supermarkets, supporting cash generation and preserving customer access to essential goods while technology teams work on restoring online commerce.

The financial significance of the episode will ultimately depend on how quickly digital services return, the extent of operating expenses incurred, and whether consumers resume their previous purchasing patterns. Ahold Delhaize has not announced an estimated loss, changed its financial guidance because of the incident, or disclosed a specific date for complete recovery across all affected brands.

The revised Albert Heijn delivery schedule is therefore a key indicator for the coming days. Its October 16 announcement eliminated the possibility of deliveries through October 20 and expressed an objective of restarting home delivery later in the following week. That remains a target rather than a confirmed reopening date, and full recovery could proceed differently across websites, applications, fulfillment operations, and customer service channels.

For shareholders, the episode reinforces cybersecurity as an enterprise-wide operational risk rather than a problem limited to information technology departments. Distribution continuity, digital sales growth, customer retention, and regulatory relationships now depend on the ability of large retailers to secure and restore increasingly interconnected systems.

As of October 16, Ahold Delhaize had made visible progress toward stabilizing its Dutch supermarket distribution network, but a return to normal digital operations remained incomplete. The central outstanding questions concern the cause of the incident, the timetable for restoring online ordering and deliveries, the results of the data security investigation, and the eventual financial cost to the group.

With physical stores functioning and grocery shelves replenished, the immediate focus is shifting from emergency product availability to rebuilding digital service capacity and customer confidence. The incident’s longer-term significance will depend on whether Ahold Delhaize can complete that recovery without further interruption and demonstrate that its infrastructure can withstand similar threats in the future.