In an announcement published by Ahold Delhaize, a leading global food retailer, the company confirmed that a significant data breach has compromised the personal information of over 2.2 million people across several countries. 

With nearly 10,000 stores located across Europe, the United States, and Indonesia, the company serves more than 60 million customers every week from all over the world, employing approximately 400,000 people. The office of the Maine Attorney General received a formal disclosure from Ahold Delhaize USA on Thursday, which stated that 2,242,521 individuals had been affected by a cybersecurity incident but did not disclose the extent of the breach to date. 

According to preliminary indications, the breach may have affected a wide range of sensitive personal information aside from usernames and passwords. Information that is potentially compromised may include the full name, residential address, date of birth, identification numbers issued by the government, financial account information, and even protected health information. 

Clearly, the scale and nature of this incident demonstrate that large multinational retailers are faced with a growing number of risks and that there is a need for improved cybersecurity measures to be taken in the retail industry. There was a cyber incident in late 2024 that was officially acknowledged by Ahold Delhaize USA last week. Ahold Delhaize USA has acknowledged this incident, revealing that the personal data of more than 2.2 million individuals may have been compromised as a result. 

According to an official FAQ, based on current findings, the company does not believe that the intrusion affected its payment processing systems or pharmacy infrastructure, which are critical areas often targeted by high-impact cyberattacks. As further support for the disclosure, documentation submitted to the Maine Attorney General's Office indicated that approximately 100,000 Maine residents were affected by the breach as a whole. 

As Ahold Delhaize USA operates multiple supermarket chains under the Hannaford brand in this region, this state-specific detail has particular significance, especially since the Hannaford brand is one of the most prominent supermarket brands in the region. It is not known yet how much or what type of data was exposed by the company, however, the widespread scope of the incident raises significant concerns about the potential misuse of personal information and the implications that could have on many individuals across multiple states. 

As far as cyberattacks targeting Ahold Delhaize USA are concerned, this incident can be attributed to a broader pattern of rising threats within the grocery distribution and food industry in general. On November 8, 2024, the parent company of the retailer publicly acknowledged the security breach, and later in April 2025, the company's parent company confirmed that the attackers had accessed sensitive data related to individuals in the Netherlands, where the company is headquartered. 

It was imperative that Ahold Delhaize USA temporarily disable portions of its internal systems during the initial stage of the incident as a precautionary measure. In addition to maintaining a significant global footprint, Ahold Delhaize operates more than 9,400 stores in Europe, the United States, and Indonesia. It is a leading multinational retailer and wholesale conglomerate with more than 9,000 stores worldwide. 

It serves approximately 60 million consumers every week both physically and digitally through its network of more than 393,000 employees. By the year 2024, the company will report annual net sales of more than $104 billion, driven by a diverse portfolio of well-known retail brands that are part of a broad range of well-known retail brands. As an example of these, in the United States, users will find Food Lion, Stop and Shop, Giant Food, and Hannaford, while in Europe, it is represented by Delhaize, Maxi, Mega Image, Albert, Bol, Alfa Beta, Gall & Gall, and Profi among a variety of banners. 

In November 2024, the company first announced its breach, stating that certain U.S.-based brands and operations, including pharmacy operations and segments of its e-commerce infrastructure, had been compromised as a result of the breach. According to a formal filing filed with the Maine Attorney General's Office on Thursday, cyberattackers gained unauthorized access to Ahold Delhaize USA’s internal business systems on November 6, 2024, and this resulted in sensitive data belonging to 2,242,521 individuals being compromised.

Although the company has not yet confirmed whether customer information was among the stolen data, it has confirmed that internal employment records were also stolen as part of the theft. Ahold Delhaize USA and its affiliated companies may have collected and stored personal information about current and former employees, raising concerns about the possibility of misuse of personal identifying information as well as employment information, among other things. 

It is evident from the scale of this breach that large, interconnected retail networks face increasingly dangerous vulnerabilities, which underscores the need to enforce robust cybersecurity practices at all levels of an organisation. It has been discovered through further investigation into the breach that the compromised files might have contained very sensitive personal information in a wide variety of forms. 

Ahold Delhaize USA Services has made it clear that the data could be potentially exposed includes the full names of individuals, their contact information (such as postal addresses, telephone numbers, and email addresses) along with their dates of birth and numerous forms of government-issued identification number, such as Social Security numbers, passport numbers, or driver’s license numbers. 

The company also reported that, besides information about financial accounts, such as bank account numbers and medical information, which can be contained within employment files, there was also potentially confidential information concerning workers' compensation records and medical records. An unauthorised party has been able to gain access to employment-related records related to current and former employees. 

After receiving a formal notification from the Attorneys General of California, Maine, and Montana regarding the breach on June 26, 2025, the company began sending notification emails to those affected by the breach. Ahold Delhaize USA Services has stated that those individuals who receive confirmation that their personal information has been compromised may be eligible for compensation under this policy. 

Whenever such a data breach occurs, the effects can be far-reaching, as sensitive personal data may be used for identity theft, financial fraud, or malicious activities. It is widely understood by security experts that companies that collect and store sensitive information are bound by legal and ethical obligations to protect that information from unauthorised access. There is a possibility that affected individuals may be able to sue for damages that result from the misuse or exposure of their personal information when proper safeguards are not observed. 

In light of the increasing frequency of these breaches, the importance of strengthening corporate data protection frameworks and swiftly addressing incidents is increasing. An organisation known as Inc Ransom, formerly linked with sophisticated ransomware campaigns, claimed responsibility for the cyberattack. It has been found that the group has participated in the cyberattack, raising further concerns about the methods used and the possibility that the stolen data may be exploited in the future. 

There has been another cyberattack which has recently struck United Natural Foods, Inc., which coincided with the timing of Ahold Delhaize USA's complete disclosure of the exposure of personal information. In the wake of this breach, UNFI, a major grocery distributor in the United States, was forced to temporarily shut down several online systems, disrupting the fulfilment process and causing delays in delivering groceries to retailers.

After containing the incident, UNFI has also restored its electronic ordering and invoicing capabilities. These back-to-back breaches highlight the growing cybersecurity vulnerabilities in the retail sector and the supply chain sector, making it increasingly important for companies to develop coordinated defensive strategies to protect sensitive consumer and business data, both of which are in urgent need.