Dutch-Belgian supermarket group Ahold Delhaize has confirmed that malicious activity was responsible for the cybersecurity incident that disrupted its operations across Europe and the United States, forcing the company to take websites, applications and other computer systems offline.

In an official statement issued on Monday, 19 October, the company announced that it had filed a formal complaint with Dutch police and was cooperating with national cybersecurity authorities. Although physical supermarkets have remained open, the disruption has affected online shopping, deliveries and some distribution operations.

The company said investigators had so far found no evidence that sensitive information belonging to customers, employees or business partners had been taken. However, its investigation remains open, and the identity and objectives of those responsible have not been publicly established.

Online services interrupted across several countries

The disruption began on 12 October, when Ahold Delhaize detected suspicious activity within its information technology infrastructure.

The group responded by taking a number of systems offline as a precaution, affecting most of its retail brands in Europe and the United States. The consequences varied considerably between businesses, with some experiencing prolonged interruption to digital services while others were able to restore operations more quickly.

Albert Heijn, the Netherlands’ largest supermarket chain, has been particularly affected. Its website and mobile application have returned online, but home grocery deliveries are not expected to resume until Friday, 23 October.

Orders scheduled before that date have been cancelled, while the company continues preparations for a gradual restoration of its online delivery service.

The incident also interrupted some supply and distribution arrangements, resulting in shortages on supermarket shelves in parts of the Netherlands and Belgium.

In Belgium, Delhaize has restored its online shopping operations. Certain promotional and personalised services were still experiencing difficulties, although the parent company confirmed that its Belgian e-commerce business was operational again.

Dutch retailers Etos and Gall & Gall have also restored their websites. Meanwhile, several American supermarket brands owned by Ahold Delhaize have continued to experience service interruptions.

The group said it expected additional online services in the United States to become available over the coming days.

Dutch authorities investigate

Ahold Delhaize said it notified the Netherlands’ National Cyber Security Centre within 24 hours of detecting the malicious activity.

The company has subsequently provided updates to the authorities and, on Monday, confirmed that a formal police report had been submitted.

Chief executive Frans Muller defended the decision to shut down digital systems, arguing that the investigation had demonstrated the necessity of taking preventive action.

The company has not identified the perpetrators, confirmed whether ransomware was involved or disclosed the technical method used to gain access to its infrastructure.

These distinctions are important because malicious activity does not necessarily establish that information was stolen or that attackers obtained control over every system subsequently taken offline.

The retailer has instead described a controlled restoration process intended to ensure that affected systems can be brought back into operation without exposing the business to further risks.

Ahold Delhaize operates thousands of supermarkets and related retail businesses, including Albert Heijn, Delhaize, Food Lion, Giant Food, Hannaford and Stop & Shop.

Its geographical reach means that a disruption originating within shared corporate infrastructure can affect several national markets, even where individual retail chains maintain separate commercial operations.

Cybersecurity becomes a supply-chain concern

The attack comes amid increasing scrutiny of the vulnerability of European food retailers to digital disruption.

Earlier this month, investigators in France began examining cyberattacks against refrigeration control systems used by hundreds of supermarkets.

Those incidents reportedly affected equipment at chains including Carrefour, Intermarché and Monoprix, with some retailers forced to discard products after refrigeration systems malfunctioned.

There is no established connection between the French incidents and the attack affecting Ahold Delhaize.

Nevertheless, both episodes illustrate the dependence of modern retail operations on interconnected digital systems supporting stock management, refrigeration, logistics, payments and customer services.

The consequences of a serious cyber incident can extend beyond the loss of access to websites. Interruptions to inventory systems, warehouse operations or communications with suppliers can affect the availability of physical products.

This creates particular difficulties for food retailers, where delays in transport and storage can result in the loss of perishable goods.

European regulatory implications

The incident also draws attention to the European Union’s NIS2 cybersecurity framework, which establishes stricter risk-management and incident-reporting obligations for organisations operating in designated sectors.

Food production, processing and distribution are among the activities covered by the directive, although its application to particular companies and operations depends on the relevant legal definitions and national implementing arrangements.

The legislation requires organisations within its scope to establish appropriate cybersecurity protections, address supply-chain risks and notify competent authorities of significant incidents.

Separately, the General Data Protection Regulation establishes notification requirements where personal-data breaches meet the relevant reporting threshold.

Ahold Delhaize’s statement that it has found no evidence of sensitive data being taken does not conclude the technical investigation, but it means that a confirmed theft of personal information should not presently be presented as a fact.

For the company, the immediate challenge remains restoring online services while maintaining normal supermarket operations. The wider commercial consequences, including the cost of the interruption and its effect on sales, have not yet been quantified publicly.

European Union governments are seeking greater flexibility over plans to remove equipment supplied by companies considered a security risk from Europe’s telecommunications networks, potentially extending the timetable for replacing Chinese technology already embedded in 5G infrastructure.

A Council draft dated 22 September removes the fixed 36-month phase-out period proposed by the European Commission, according to a document reported on 29 September. Instead, member states want the timetable to take account of the level of identified risk, product and infrastructure lifecycles, normal equipment replacement cycles, interoperability requirements and the availability of suitable alternatives.

The change would not abandon the EU’s attempt to reduce reliance on suppliers considered high risk. It would, however, remove a uniform deadline and give considerably more weight to the practical and financial consequences of replacing equipment already installed across European networks.

The Commission proposed a revision of the EU Cybersecurity Act on 20 January, seeking to establish a common European framework for addressing security risks in information and communications technology supply chains rather than relying principally on separate national measures.

For mobile telecommunications, the practical effect would fall particularly heavily on Chinese suppliers Huawei and ZTE. Under the Commission’s proposal, mobile operators would have three years to remove equipment from suppliers formally classified as high risk.

As EU Today reported when the proposal was unveiled, the measure represented a significant shift from the EU’s existing 5G security framework. Restrictions on Huawei and ZTE have previously depended heavily on decisions taken by individual member states, producing markedly different timetables across the Union.

Operators put replacement cost at €40bn

The pressure to change the timetable follows warnings from Europe’s largest telecommunications groups over the cost of removing existing equipment.

Seventeen industry executives, including senior figures from Deutsche Telekom, Orange and Telefónica, warned earlier this month that replacing equipment affected by the proposed restrictions could cost the sector as much as €40 billion.

The operators argued that such expenditure would draw investment away from fibre networks, further 5G deployment and preparations for 6G. The issue is particularly significant in Germany, Italy and Spain, where Huawei equipment remains extensively used in parts of existing telecommunications infrastructure.

Replacing one supplier’s equipment is not simply a matter of purchasing alternative hardware. Mobile networks contain generations of interconnected equipment installed over many years, while operators must continue providing services during any transition.

The Council’s proposed approach would allow these factors to influence how quickly individual components are removed. Equipment judged to present an immediate or particularly serious risk could face a shorter deadline, while other infrastructure could potentially remain in operation until a scheduled replacement becomes technically and economically practical.

From Huawei to wider supply-chain security

The dispute is broader than Huawei or mobile networks.

The revised Cybersecurity Act is intended to establish an EU-wide framework for dealing with dependence on third-country suppliers across critical ICT infrastructure. The Commission says the legislation would introduce a harmonised and risk-based approach to supply-chain security, including risks associated with foreign interference.

In February, the EU also introduced an ICT Supply Chain Security Toolbox, setting out measures for identifying and mitigating risks associated with critical suppliers. These include multi-vendor strategies and measures intended to reduce dependence on suppliers considered high risk.

The Commission’s January proposal goes considerably further. It covers a range of critical sectors beyond telecommunications, including connected vehicles, electricity infrastructure, water systems, drones, cloud services, medical devices, surveillance technology, space services and semiconductors.

Under the proposed system, restrictions would follow a formal risk assessment initiated by the Commission or at least three member states, accompanied by market and impact assessments.

Huawei has consistently rejected claims that its equipment represents a security threat and has opposed measures that it argues discriminate against suppliers on the basis of their country of origin.

The Commission has taken a different position. Its approach to the security of Europe’s ICT supply chains is increasingly focused not only on technical vulnerabilities but also on strategic dependence on suppliers from third countries.

Deadline now part of negotiations

The Council changes are not final. Member states must agree their negotiating position, while the revised Cybersecurity Act will ultimately require agreement with the European Parliament before becoming law.

The emerging position nevertheless points towards a significant change from the Commission’s original model.

Rather than requiring mobile operators across the EU to remove high-risk equipment within the same 36-month period, governments want deadlines to reflect the risk associated with particular equipment, its remaining operational lifetime and whether suitable replacements are available.

That could leave the EU with the same strategic objective — reducing dependence on suppliers considered a security risk — but a considerably longer and more differentiated timetable for achieving it.