Food Retail Giant’s Breach: 2.2 Million Employees Affected

Food retail giant Ahold Delhaize USA is notifying 2.2 million current and former employees that a November 2024 data breach exposed their personally identifiable information.

See Also: On Demand | Global Incident Response Report 2025

The U.S. subsidiary of Dutch-Belgian multinational retail and wholesale holding company Ahold Delhaize runs the largest collection of grocery stores on the U.S. East Coast, and the fourth largest in America, under such brands as Food Lion, the Giant Company, Hannaford and Stop & Shop.

“We detected a cybersecurity issue involving unauthorized access to some of our internal U.S. business systems on Nov. 6, 2024,” the company said. The company said the breach and data theft appeared to have begun on Nov. 5, 2024.

Information exposed for current and former U.S. employees could include people’s name and full contact details, date of birth, Social Security, passport or driver’s license number, bank account numbers, as well as health data – “for example, workers’ compensation information and medical information contained in employment records – as well as other employment details. “The types of impacted information vary by affected individual,” the company said.

The company publicly detailed the breach on Nov. 8, 2024, saying it took offline multiple systems as part of its incident response, resulting in disruptions to online orders and its pharmacies. The company said it quickly brought those systems back online.

The INC ransomware group, in an April 16 post to its data-leak site, took responsibility for breaching Ahold Delhaize and claimed to have stolen data, which it threatened to leak in full after releasing samples. The ransomware group has been in operation since mid-2023, and often infects victims through phishing emails or exploit kit malware, said cybersecurity firm SentinelOne. Like many ransomware operations, the group doesn’t attack Russia, suggesting it’s based there or in a neighboring country.

On April 17, Ahold Delhaize first confirmed publicly that hackers stole data in the attack, and said it was reviewing the exposed files to identify the PII at risk.

“Based on this review, we recently learned that certain Dutch employment data may have been contained in the affected files,” it said at the time. “We have notified the Dutch Data Protection Authority.” The company said that exposed information pertained to an unspecified number of employees of Ahold Delhaize Group, Ahold Delhaize Europe & Indonesia Albert Heijn, Etos, Gall & Gall and the Ahold Delhaize Coffee Company in the Netherlands, “who were on the payroll in April 2021.”

The company has taken seven months, post-breach, to identify which U.S. individuals were affected. “These investigations are complex and time intensive,” the company said.

The cyber incident involving one of the world’s largest food retail groups follows a number of other high-profile incidents in the same sector, affecting the likes of U.S. retail giant Sam’s Club as well as United Natural Foods, the largest health and specialty food distributor in the United States and Canada, and the main supplier for high-end supermarket chain Whole Foods (see: Whole Foods Supplier Faces Cyberattack Disrupting Operations).