Ahold Delhaize made the hard call in a day and left the easy one to whoever happened to be holding the keyboard.
“Reality must take precedence over public relations.”
Richard Feynman, Rogers Commission Report, 1986
THE SIGNAL
Ahold Delhaize detected suspicious activity on its network on Sunday, October 11.
By Monday the websites and apps of Stop & Shop, Food Lion, Hannaford and both Giant banners were dark, along with Albert Heijn, Etos and Gall & Gall in the Netherlands.
Stores stayed open. Online ordering stopped for a company that serves about 77 million customers a week.
Most coverage tracked how long the sites stayed down and whether data walked out the door.
That was the noise.
The signal was what each layer of the company told people, and who decided it. US e-commerce did not fully return until October 21. This was Ahold’s second major cyberattack in two years, after a November 2024 attack hit more than 2 million US customers.
THE FAILURE POINT
October 12 and 13. Three versions of the same event went public. Ahold Delhaize USA’s corporate site said it was “experiencing a security issue” within its network.
Stop & Shop’s website showed a maintenance message promising refunds on unfilled orders. By Tuesday the group was telling the Boston Globe it was experiencing a cyberattack.
Nobody had been named to own the one sentence a customer should hear, so each layer wrote its own.
On October 13 the group announced a controlled relaunch of certain systems. US sites stayed down for eight more days.
SIGNAL WITHIN THE SIGNAL
Signal Compression, running outward instead of upward.
The security team saw enough to pull revenue offline on two continents and notify the Dutch National Cyber Security Centre within 24 hours.
One layer out, that became a security issue. At the brand level it became a maintenance page. The formal statement of cause, “malicious actions of others,” and the police report both waited until October 19.
Each version could be defended in a meeting. None of them told a shopper planning dinner around a delivery slot what had happened or when it would end.
Worth checking where your own team sits on that same gap before assuming it's someone else's problem.
Score your gap →
BEHAVIOR UNDER PRESSURE
The containment call was disciplined.
Someone took revenue-producing systems offline without waiting for certainty, and most companies flinch on that one. CEO Frans Muller said on October 19 that taking the systems offline was the right decision.
The communication ran the other way.
When BleepingComputer asked whether store systems were hit or devices encrypted, a spokesperson pointed back to the company statement.
RetailDetail noted that the October 19 release never explained why the police report took more than a week.
By the time US sites came back, Food Lion and Giant were offering online discounts to bring customers back.
SYSTEM DRIVER - MOS
The system produced fast containment and slow, fragmented disclosure because the two sat with different owners on different clocks.
Security acts on suspicion. Communications waits for legal, and the brand sites fill the gap with whatever template is already loaded.
One structural fix: the incident owner who signs the shutdown also signs the first customer-facing sentence, against a disclosure standard written before anything breaks.
That sentence goes to every brand site at the same time. It says what is known and when the next update lands. No brand writes its own.
SignalWalk audits your tier meetings from your phone. Capture the moment a problem leaves the room without an owner and get a PDF score. Get SignalWalk
LEADER DRIVER - INTERNAL OPERATING SYSTEM (IOS) - REGULATE
The pressure on whoever approved those statements was specific.
A second attack in two years.
The 2024 breach still fresh in the coverage.
The same night, hackers pushed refrigerators at roughly 700 French supermarkets to 50°C. The read suggests the cost of saying “attack” again weighed as heavily as the operational facts, and that letting each layer speak for itself felt safer than one signature.
The override threshold that likely would have changed the read: once systems go dark for security reasons, one named person owns every public word about it.
Tomorrow’s headline is something that person handles tomorrow.
IF YOU DO ONE THING TODAY
Pull your incident communication template and your last outage notice from each brand, site or business unit you run.
Check whether they use the same words.
Then write one name on the template as the person who approves the first customer-facing sentence in the first two hours, and send that name to every team that owns a website or app before you leave today.
FINAL SIGNAL
The decision to go dark had an owner, and the sentence explaining it never did.
CTA
Count the layers your bad news passes through before a customer hears it. Run the Signal Compression diagnostic at mosei.org.
SOURCES
Ahold Delhaize statements (Oct. 12, 13 and 19, 2026), Ahold Delhaize USA (Oct. 12, 2026), WTNH (Oct. 12, 2026), Boston Globe (Oct. 12, 2026), BleepingComputer (Oct. 12 and 20, 2026), Supermarket News (Oct. 12 to 19, 2026), CyberGuy (Oct. 14, 2026), Reuters (Oct. 19, 2026), NL Times (Oct. 19, 2026), RetailDetail (Oct. 20 and 21, 2026), Chain Store Age (Oct. 12 and 21, 2026), AP (Oct. 13, 2026).