Ahold Delhaize, the Dutch-American retail conglomerate operating Stop and Shop, Giant Food, Food Lion, and more than a dozen other US grocery chains, confirmed an active cyberattack on October 22 affecting pharmacy IT systems across its US retail network.
What happened
The attack began around October 20 and affected systems supporting pharmacy operations, including prescription management and insurance billing. Stop and Shop locations in the US Northeast reported pharmacy closures and manual fallback procedures at the store level. Ahold Delhaize confirmed the incident on October 22 but has not disclosed the attack type, whether data was exfiltrated, or whether any ransomware group has claimed responsibility.
Ahold Delhaize is a significant retail infrastructure operator: it runs approximately 2,000 stores across the US under the Stop and Shop, Giant Food, Food Lion, Hannaford, and Martin's Food Markets brands, with consolidated revenue of roughly $90 billion. Its US pharmacy network serves millions of customers and is integrated with major insurance carriers, making it a sensitive target for data extortion.
What we know so far
- Incident first observed Oct 20; pharmacy disruptions reported Oct 21; public confirmation Oct 22.
- Confirmed affected: US pharmacy systems including prescription processing and insurance adjudication. Other store systems (point-of-sale, inventory) not confirmed affected.
- No ransomware group has publicly claimed responsibility as of this post. Operational profile (pharmacy targeting, disruption focus) is consistent with ransomware or destructive wiper activity.
- Ahold Delhaize public statement (Oct 22): We are aware of a cybersecurity issue affecting certain systems within our US network. We have taken steps to isolate and contain the issue. No additional technical detail provided.
Why this matters
Grocery retail pharmacy operations occupy a uniquely sensitive position in the data landscape: they hold protected health information (PHI) under HIPAA, process insurance claims through clearinghouse networks, and maintain long-term customer medication histories. A successful exfiltration from Ahold's pharmacy systems would expose PHI for a large slice of the US Northeast population.
Retail grocery chains are also increasingly classified under food and agriculture critical infrastructure. This incident is likely to attract CISA attention if it remains unresolved. Comparable incidents -- notably the 2022 Sobeys attack and the 2023 Cencosud incident -- involved weeks of pharmacy disruption and multi-million-dollar recovery costs.
What to do
- If your organization supplies services or software to Ahold Delhaize or any of its US retail brands, evaluate your contractual obligations under their data processing agreements and assess exposure from shared credentials or API integrations.
- Grocery sector security teams: review your pharmacy system segmentation. If pharmacy IT shares network segments or directory services with general retail operations, that lateral path is a likely attack vector.
- Monitor the Ahold Delhaize newsroom and major ransomware leak sites. If a group claims the attack in the next 48-72 hours, a data disclosure window opens. Health system CISO teams in the Northeast should be on elevated watch.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if you need help assessing your organization's exposure to retail and supply chain incidents.