15 OCT 2026 — Days after a cyber incident forced Ahold Delhaize to take systems offline across Europe and the United States, Dutch police say there is no criminal investigation. The reason: the company has not filed a police report. In a statement on 14 October, the police and the Public Prosecution Service (OM) said they had been in contact with the retailer and had "invited" it to file one.
The grocer, which owns Albert Heijn in the Netherlands, Delhaize in Belgium and Food Lion and Stop & Shop in the US, did notify the authorities that Dutch law requires it to. The gap between regulatory notice and a criminal complaint explains a lot about how large companies handle these attacks.
What Ahold has said
Ahold Delhaize first disclosed "a cybersecurity issue within its network" on 12 October. In an update dated 13 October and revised the next day, it said it had taken "some systems offline" as a precaution and was starting "a controlled re-launch of certain systems". It said it was working with outside cybersecurity experts and "engaging with the appropriate authorities and other stakeholders as necessary".
On data, it was careful: "we have no evidence at this moment that customer, associate and partner data was taken." Stores stayed open in Europe and the US, though the company said the effect of its precautions "differs per brand". It has not said what kind of attack it is dealing with.
Notice to regulators, not to police
The police statement draws the line between a mandatory notice and a criminal complaint. Companies covered by the Netherlands' new Cyberbeveiligingswet (Cybersecurity Act) must report incidents of this kind to the National Cyber Security Centre, and the police said Ahold Delhaize "acted in accordance with this duty". That notice can help investigators, for instance by letting them compare an attack's technical features with similar incidents. It does not start a criminal case.
"To successfully track down and prosecute, it is crucial to always get information from victims as quickly as possible," the police wrote. They also described cybercrime as "a criminal ecosystem", with almost every attack backed by "a criminal supply chain" of cooperating offenders and services.
According to DutchNews, Ahold said it would "work with all relevant authorities", gave no reason for not filing, and said it would make no further statements. Companies sometimes delay a police report while forensic work is under way or while they weigh what a report would make public. Ahold has not said whether either applies.
What shoppers saw
Shoppers could see the disruption. DutchNews reported that the incident also hit Ahold's Etos and Gall & Gall chains, that online ordering and deliveries stopped, and that fruit and vegetable shelves ran low. By Thursday, Albert Heijn said its distribution centres were running again and that deliveries of non-perishable goods were fully restored, with fresh deliveries resuming that night. Its website and delivery service were still down.
The Financieele Dagblad, citing anonymous sector insiders, put the cost at "tens of millions" of euros a day. Ahold told the paper it was too early to say. In the US, Cybersecurity Dive reported on 14 October that the websites and apps of all five of Ahold's American banners, including Food Lion and Stop & Shop, had been down for at least three days. Notices told customers that unfulfilled online orders would be refunded, and that stores and pharmacies were keeping normal hours.
Retail as a target
The attack came the same weekend as a separate one on French supermarkets, DutchNews noted. RECATOOLS covered that case, in which attackers reached store refrigeration controllers. Ahold has been here before. A 2024 incident took some of its systems and banner websites offline and potentially exposed information on more than 2 million people, Cybersecurity Dive noted. Grocers make attractive targets because they run on thin margins and cannot hold fresh stock for long. Every day offline costs money and goodwill.
What to watch
Three questions are still open: the type of attack, whether any data was actually taken, and whether Ahold files the police report. The company has promised further updates "when appropriate". As a listed retailer, Ahold will also have to put a number on the disruption in its next quarterly results.
