Ahold Delhaize Calls Its Cyberattack Shutdown 'The Right Decision.' A Week Later, Customers Still Can't Order Online.

What happened. On October 11–12, 2026, grocery giant Ahold Delhaize detected a cyberattack and proactively took IT systems offline across most of its US and European retail brands — Stop & Shop, Food Lion, Giant Food, Hannaford and The GIANT Company in the US, and Albert Heijn in the Netherlands. Physical stores stayed open, but websites, mobile apps, online ordering, digital coupons and gas-rewards programs went dark across the affected chains.

The company defended the shutdown — in public, fast. On October 19, CEO Frans Muller said in a statement: "Taking systems offline to help protect them was a precautionary measure that affected most of our brands across Europe and the United States. The investigation to date confirms this was the right decision." The company said its investigation so far had found no evidence that customer payment or personal data had been exposed. That same day, Dutch brand Albert Heijn filed a police report describing "suspicious" activity tied to the same incident.

A goodwill gesture, but the outage dragged on. On October 16, Stop & Shop offered customers a 10% discount (up to $10, redeemable through a Savings Station kiosk or a GO Rewards account) through October 22 to offset the inconvenience. But as of this writing, Stop & Shop's website and app remain offline more than a week after the attack, with no restoration date announced, and employees have reported trouble accessing their own schedules and pay stubs.

It's happened before. This is Ahold Delhaize's second major cyberattack in two years — a November 2024 incident disrupted Stop & Shop's pharmacy systems and delayed Food Lion deliveries. Reporters covering this round have already started asking the harder question: what, if anything, changed after 2024?

Why it matters.

1. A fast, public, on-the-record defense of an unpopular decision — Muller naming the tradeoff and standing behind it within a week — beats silence or a vague "we're investigating" holding statement.
2. Stating plainly that no customer data has been found exposed closes off the worst-case rumor mill before it starts, but only works if it stays true as the investigation continues.
3. A dated, concrete goodwill gesture (10% off, expires October 22) gives customers something more persuasive than an apology alone — though it can't substitute for the service actually coming back.
4. An outage measured in days, not hours, erodes the credibility of "the right decision" — customers judge the outcome, not just the intent behind the call.
5. A repeat incident changes the story from "a company responding well to bad luck" to "a company whose defenses didn't improve the first time" — and that framing, once a reporter reaches for it, is hard to unwind.

Sources: The Register, NBC Boston, SecurityWeek, NL Times

Standing behind a hard call in public is only half the job — the other half is how long "the right decision" takes to feel right to the customers living with it. CGS.GURU helps businesses close that gap before the next outage starts the clock. Get in touch to review your reputation strategy.