You stop noticing convenience the moment it becomes a habit. The grocery app turns into something closer to a utility, like water or Wi-Fi.
You build a Sunday routine around it. You tap in the milk, the diapers, and the chicken thighs, then pick a pickup window and get on with your week. Then one morning the app just spins, and the pickup slot you booked no longer exists.
That habit is now a big business. Grocers have spent years pushing shoppers toward their apps because a customer who orders online, clips digital coupons, and sticks with a loyalty program is a customer who keeps coming back.
Ahold Delhaize (ADRNY) leans on that model harder than most. Roughly a third of its U.S. customers are “digitally engaged,” NL Times reported, citing the Dutch company.
So when the digital front door slams shut, millions of households feel it at once. That is exactly what’s happening to Food Lion and Stop & Shop customers this week, as their online ordering remains offline for a third straight day.
Food Lion and Stop & Shop online orders go dark
The trouble started Sunday, Oct. 11, when Ahold Delhaize detected a cybersecurity incident, according to Supermarket News. By Monday, Oct. 12, websites for all five U.S. banners were down, including Giant Food and The Giant Company.
The company said it took “precautionary measures, including taking some systems offline to help protect them,” reported Fox 5 New York. It added that it is beginning “a controlled relaunch of certain systems.”
Related: Kroger, Albertsons have new plan for your grocery shopping
Stores, pharmacies, and fuel stations remain open. Food Lion’s site tells customers to order through Instacart, DoorDash, and Uber Eats instead, and any unfulfilled orders “will be refunded,” according to that same message.
Ahold Delhaize has said there is “no indication that client data has been stolen,” the Boston Globe reported. It has not said what caused the incident or when service will fully return.
Hannaford shoppers in Northern New England are stuck, too
This isn’t only a Southeast and Northeast-corridor problem.
Hannaford, the Scarborough, Maine-based chain with stores across Maine, New Hampshire, Vermont, Massachusetts, and upstate New York, is offline as well.
More Retail:
- Ross Stores enters a new market as customers hunt for low prices
- 92-year-old RaceTrac convenience store chain opens locations in new major market
- Grocery Cart Price Check: How Publix, Walmart, and Aldi compare
Hannaford’s website, mobile app, and To Go pickup and delivery services were all hit, the Boston Globe reported. “Hannaford stores remain open and continue to welcome customers,” a company spokesperson said.
Ahold Delhaize told Reuters the incident does not appear connected to a separate attack that spoiled food at French supermarkets, according to the New Hampshire Union Leader. That French attack overheated refrigeration at roughly 700 stores, the Globe reported, citing French Finance Minister Roland Lescure.
For rural shoppers in Maine or Vermont, losing pickup is not a minor annoyance. The nearest alternative store can be a long drive away.
This isn’t the parent company’s first cyberattack
Here is the part most outage coverage glosses over. Ahold Delhaize USA went through almost the same thing in November 2024, and the recovery was slow.
When I lined up the two incidents, the opening moves were nearly identical: a vague “security issue,” systems pulled offline, stores open, websites down. Here is how the last one played out.
- Nov. 8, 2024: Ahold Delhaize USA disclosed a cybersecurity issue in its U.S. network and notified law enforcement, according to VTDigger.
- Mid-November 2024: Hannaford’s website and To Go service stayed down for more than 10 days, reported NewsCenter Maine.
- Late November 2024: At least 27 Stop & Shop stores struggled to stock shelves the week before Thanksgiving, according to NBC News.
- June 2025: The company notified 2,242,521 people that their data was exposed, according to a Maine attorney general filing cited by Security Affairs.
That stolen file trove included Social Security numbers, bank account numbers, and health information from employment records, the filing said. The ransomware gang INC Ransom later claimed the attack and posted about 800 gigabytes of the data, Security Affairs reported.
My analysis of the Maine numbers shows how local this gets. Ahold disclosed that 95,463 Maine residents were affected, Supermarket News reported, or about 4% of everyone notified, in a state with roughly 1.4 million residents.
How a grocery outage can quietly hit your wallet
Today’s outage looks like a website problem. For your budget, it’s a little bigger than that.
If you shift to third-party delivery, you’re paying those apps’ own delivery and service fees, and you may lose the store’s digital coupons. Food Lion customers can still pull up offers at in-store kiosks, a spokesperson told The Baltimore Banner.
Here’s what I’d do this week if I were shopping at any of these chains:
- Check your card statement for any canceled order that hasn’t been refunded yet.
- Change your grocery app password once the site is back, especially if you reuse it elsewhere.
- Treat any “refund” email with suspicion and go to the app directly instead of clicking links.
If you got a breach letter in 2025, that’s your cue to make sure a credit freeze is still in place. Freezes at all three bureaus are free, and they stop anyone from opening new credit in your name.
What customers and investors should watch next
The cost of getting this wrong keeps rising. The average U.S. data breach hit a record $10.22 million in 2025, IBM found in its annual report, according to Cyberscoop.
Investors have been fairly calm so far. Ahold Delhaize shares bounced 0.7% on Tuesday, Oct. 13, after falling the day before, according to Dutch wire service ANP.
The real test is the next update. If the controlled relaunch drags past a week the way it did in 2024, the story shifts from a technical glitch to a question about whether two years of security spending actually worked.
Your grocery app is a convenience. Treat the account behind it like a bank login, because that’s closer to what it is.