Ahold Delhaize data breach exposes personal information of over 2.2 million individuals

Dutch-Belgian multinational retail and wholesale company, Ahold Delhaize, said that the data security incident it suffered last year compromised the sensitive personal data of more than 2.2 million individuals.

 

In a data security incident notice filed with the Office of Maine Attorney General, Ahold Delhaize, the parent company of Stop & Shop, Hannaford, Food Lion, and Giant Food, said that on  November 6, its USA arm detected a cyber security incident affecting its internal network.

 

The company immediately launched an investigation, with assistance from external cyber security experts, to determine the nature and scope of the incident. Ahold Delhaize USA also notified relevant law enforcement authorities and is working with them to resolve the situation.

 

“Based on our investigation, we identified that an unauthorised third party obtained certain files from one of our internal U.S. file repositories between November 5 and 6, 2024,” Ahold Delhaize said.

 

The compromised data included names, postal and email addresses, phone numbers, dates of birth, Social Security Numbers, passports, driver’s license numbers, financial account information, health information and employment-related information. 

 

The filing with the Maine state regulator also states that the company has identified at least 2,242,521 individuals impacted by the incident.

 

Ahold Delhaize USA has advised all affected individuals to regularly monitor their credit reports, account and benefit statements and report any suspicious activity to law enforcement authorities, including the police and the state attorney general.

 

It has also offered two years of complimentary identity protection and credit monitoring services through Experian to all affected individuals.

 

 

In April, the INC Ransom ransomware group claimed responsibility for the cyber attack on Ahold Delhaize and listed the company as a victim on its data leak site. The group said it had stolen 6TB of sensitive data, and published the same, indicating a failed ransom negotiation.