Ahold Delhaize says it has filed a formal police report with Dutch police as it continues recovering from a cybersecurity incident that led the retailer to take systems offline across much of its European and U.S. business.
In its October 19 update, the company said it detected suspicious activity in its IT infrastructure, engaged cybersecurity experts and concluded that the activity resulted from “the malicious actions of others.” As a precaution, it took certain systems offline, including brand websites and apps. The company said the action affected most of its brands in Europe and the United States, with varying effects by brand; stores remained open.
Ahold Delhaize said it notified the Dutch National Cyber Security Centre within 24 hours of detecting the activity and has continued to update the NCSC, law enforcement and other regulators. It did not identify an intrusion method, threat actor, affected software, CVE or a specific remediation action beyond its system shutdown and restoration work.
The company said Albert Heijn’s website and app were back online, while home deliveries were expected to resume Friday, October 23. Etos and Gall & Gall websites were available, Belgium e-commerce was fully operational, and most Central and Southeastern Europe brand sites and apps were available. U.S. e-commerce services were expected to return in the coming days.
The investigation is still under way. Ahold Delhaize said it had no evidence at that point that sensitive customer, associate or partner data had been taken. BleepingComputer reported that customer websites, apps and customer-service platforms had been unavailable at several Dutch and Belgian brands, while Stop & Shop employees reported access problems with schedules and pay stubs.
For defenders, the currently confirmed facts are limited to malicious activity, precautionary system shutdowns and continuing service restoration. The company has not published technical indicators, affected versions, an exploitation vector or patch guidance.