Why Supermarket Cyberattacks Shut Down Stores: Ahold Delhaize to M&S

When a supermarket chain announces it has taken "precautionary measures" after a cybersecurity incident, the outage you notice at the pharmacy counter was usually caused by the company itself. That is not a criticism. It is how modern incident response works, and it explains why grocery hacks hurt shoppers far more than the stolen data alone would suggest.

Ahold Delhaize, which owns Stop & Shop, Food Lion, Hannaford, Giant Food and The Giant Company in the US, issued the clearest recent example of this. Read alongside attacks on Marks & Spencer, the Co-op and wholesaler UNFI, it shows a pattern that will likely repeat.

What Ahold Delhaize actually disclosed

Fact: In early November 2024, Ahold Delhaize USA said it had detected a cybersecurity issue in its US network. The company stated it had brought in external security experts, notified law enforcement and taken some systems offline to contain the problem. Stores stayed open, but Stop & Shop warned that some pharmacies and e-commerce operations were affected, and Hannaford's website and app went down for days.

Fact: The data side arrived later. In a June 2025 filing with the Maine attorney general, the company reported that about 2.2 million people were affected, with stolen files including personal information and, for many people, employment-related records. The ransomware group INC Ransom had listed Ahold Delhaize on its leak site that April. The gap between the first press release and the notification letters was roughly seven months, which is normal for an incident of this size and still a long time to wait if your details were in the files.

The outage is partly a decision

Interpretation: "Precautionary measures" is a polite phrase for pulling cables. Once a company suspects an intruder is inside its network, it faces a choice between keeping systems running and risking further spread, or isolating them and accepting the disruption. Most security teams choose isolation, and they are right to.

The systems that get cut first tend to be the ones most connected to everything else: online ordering, loyalty accounts, pharmacy platforms that talk to insurers. The checkout still works because tills can run in a degraded mode. The prescription refill does not, because it depends on a chain of networked services that the company has just deliberately broken. Shoppers experience this as "the hack took down the pharmacy" when the more accurate version is "the company sacrificed the pharmacy to protect the rest."

Companies that have already been through a similar scare, and kept clean offline copies of their systems, recover faster. Those that discover their backups were reachable from the same network learn the lesson described in why backups now feature in ransom negotiations.

The same pattern, three more times in 2025

Fact: Marks & Spencer was hit over Easter weekend in April 2025. Contactless payments faltered and online orders were paused for around seven weeks. In May the company estimated the incident would cost about £300 million in operating profit, and confirmed some customer personal data had been taken.

Fact: The UK's Co-op was attacked the same month. It shut down parts of its IT estate, some stores ran short of stock, and chief executive Shirine Khoury-Haq later said data belonging to all 6.5 million members had been taken. In June, United Natural Foods, the main distributor for Whole Foods, detected unauthorized activity and took systems offline, disrupting deliveries to retailers across North America.

Several of the 2025 UK attacks were reported to involve social engineering of help desks: attackers persuading staff to reset credentials rather than cracking anything clever. That is the weak point described in how account recovery became the easiest way in.

Why grocers make attractive targets

Interpretation: Grocery retail runs on low single-digit net margins, perishable stock and just-in-time deliveries. A bank can tolerate a day of degraded service. A supermarket with a warehouse full of chilled food and no working ordering system starts losing money by the hour, and that time pressure is exactly what ransomware crews want to exploit.

Grocers also hold a stranger mix of data than people assume. Pharmacies keep prescription histories. Loyalty schemes record years of purchases tied to a name and address. Large chains employ hundreds of thousands of people, which is why Ahold Delhaize's breach included so many employment records. One intrusion can touch health data, shopping habits and payroll in a single network.

What shoppers should actually check

If you shop at an affected chain, a few steps are worth the ten minutes:

Read the letter, not the headline. Notification letters list which categories of data were exposed for you specifically. A loyalty email address is a nuisance. A Social Security number or health information is a different problem.

Expect breach-themed phishing. Scammers send fake "your data was exposed, click to claim protection" emails within days of any big announcement. Go to the retailer's site directly instead of following links.

Have a pharmacy fallback. If you rely on regular prescriptions, know how to transfer one to another pharmacy or get an emergency supply. Outages like Stop & Shop's last days, not hours.

Freeze your credit if identifiers leaked. In the US, freezes at Equifax, Experian and TransUnion are free and reversible. Change any loyalty account password you reused elsewhere.

What is likely to happen next

Prediction: More retailers will choose fast, visible shutdowns over quiet containment. M&S and the Co-op showed that a seven-week outage is survivable, and boards have absorbed that a short self-inflicted disruption is cheaper than an attacker roaming free for months.

Prediction: Regulation will chase payments rather than prevention. In July 2025 the UK government said it would ban ransom payments by public bodies and critical national infrastructure operators, while requiring other organizations to notify the government before paying. Private retailers like M&S would not be covered by the ban as proposed, so the incentives for grocers stay largely where they are.

Prediction: The notification gap will remain the shopper's real problem. Seven months between "precautionary measures" and a letter in the post is long enough for leaked data to be sold and reused. Until disclosure rules tighten, the safest assumption after any grocery hack is that your details were included, and the letter will eventually confirm it or pleasantly surprise you.