Hackers stole data on 2.2 million people in cyberattack affecting American grocery chains

The Dutch conglomerate behind dozens of major American supermarket brands said more than 2.2 million people had information stolen from its systems during a cyberattack in November that left customers unable to place delivery orders online.

Ahold Delhaize filed documents with regulators in Maine on Thursday explaining that the stolen information includes Social Security numbers, passports, financial account information like bank numbers, health information, and other sensitive employment data.

The company owns Food Lion, Giant Food, Hannaford, Stop & Shop and other U.S. brands. Letters to victims say the company discovered the cyberattack on November 6 and an investigation revealed hackers began stealing data the day before. 

The INC ransomware gang took credit for the attack in April, claiming to have stolen six terabytes of information.

Ahold Delhaize said its investigators found that the files accessed “included internal employment records containing personal information…that we obtained in the course of providing services for certain current and former Ahold Delhaize USA companies.”

Victims are being given two years of credit monitoring services. 

Ahold Delhaize USA has more than 2,000 stores across the country and is one of the world’s largest food retail groups, reporting net sales in 2023 of more than $24 billion. In November, shoppers across the country were unable to place grocery delivery orders online and websites for some of the supermarket brands were offline. 

The notice comes as another large grocery store giant deals with the fallout of a cyberattack. Whole Foods and other North American brands struggled for weeks this month after distributor United Natural Foods was hit with a cyberattack that took down its digital distribution system.

The distributor told the Securities and Exchange Commission on Thursday that it “experienced reduced sales volume and increased operational costs” in the immediate aftermath of the incident.