GIANT's Website Is Still Dark. Its Registers Are Not.
Six days after a cybersecurity incident at its parent company, GIANT's website and app are still unusable. Shoppers opening giantfoodstores.com on Saturday, Oct. 17 were met with the same apology they saw a week earlier: "Our GIANT website and app are currently unavailable, and we're working to restore service as quickly as possible." The lights are on in the stores. GIANT and MARTIN'S supermarkets, pharmacies and fuel stations are operating at normal hours — what is missing is everything that runs through the company's own digital channels: online ordering, curbside pickup, delivery and app-only digital coupons.
GIANT belongs to Ahold Delhaize, the Zaandam, Netherlands-based retailer whose U.S. banners also include Food Lion, Stop & Shop, Hannaford and the separately run Giant Food of Landover, Md. On Monday, Oct. 12, the company said it was experiencing a security issue within its network. "Our teams are taking steps to assess and mitigate the issue. This includes taking some systems offline to help protect them. At this time, our stores are open and serving customers," it said.
Reuters reported the outage began Oct. 11, disrupted distribution centres and led to empty produce shelves at Albert Heijn, the Dutch chain, which does not expect online delivery to resume before Sunday. Local Pennsylvania outlets reported GIANT's site went offline late Sunday — a day before the company went public.
Tuesday's update delivered the first substantive finding: the investigation is ongoing, but there is "no evidence at this moment that customer, associate and partner data was taken in this cybersecurity incident." Wednesday's update said teams were working "with urgency" to investigate and restore systems safely, and apologized for the disruption. Reporters treated the no-data-theft statement as preliminary, not settled.
The company said Tuesday it had begun a "controlled relaunch" of certain systems. abc27 reported the relaunch actually started late Wednesday and did not yet appear to cover the websites and apps for GIANT and MARTIN'S in Pennsylvania. No timeline has been given; the company says it will provide further updates "when appropriate."
Ahold Delhaize has not confirmed whether ransomware was involved, no threat group has claimed responsibility and no stolen data has surfaced on the dark web. The timing coincided with an attack on French supermarkets, where refrigeration systems at hundreds of stores were pushed as high as 50°C (122°F) for about six hours, spoiling large volumes of food and sparking fires. No evidence yet links the two.
In November 2024, the INC Ransom group hit Ahold Delhaize's U.S. systems, exposing the personal, financial and health data of more than 2.2 million people; the company offered two years of free credit monitoring. Media have called this week's episode the company's second major cybersecurity event in two years.
GIANT operates 168 locations across Pennsylvania, plus pharmacies and gas stations. The five U.S. banners together account for more than 1,000 stores; the group runs more than 9,400 stores worldwide with roughly 400,000 employees and about 60 million customers a week. In Maryland alone there are 94 Giant and 52 Food Lion stores; Giant Food has 159 locations across Maryland, D.C. and Virginia, and Food Lion 338 in Maryland and Virginia. Online ordering, pickup, delivery and app-only offers are down, and Stop & Shop employees have reported trouble accessing schedules and pay stubs.
Spokeswoman Ashley Flower said customers can ask store teams about the week's digital offers at checkout or customer service. Starting Friday, Oct. 16, GIANT automatically activated every digital coupon in the new weekly circular for GIANT and MARTIN'S cardholders; fuel rewards still accrue and redeem. In-store Savings Station kiosks load the week's deals and print a confirmation slip, and Food Lion customers can do the same.
In an email Friday, GIANT offered 10% off in-store grocery purchases — capped at $10, limited to one per household and no loyalty card required — plus $15 off orders of $75 or more placed through Instacart, DoorDash or Uber Eats, valid through Oct. 19. Unfulfilled orders placed on GIANT's own site or app will be refunded, and the company says stores are receiving deliveries.
On Friday, Dutch Justice Minister David van Weel urged Ahold Delhaize to file a criminal complaint over what the company still calls a cybersecurity incident. Police and the Public Prosecution Service have been in contact and extended an invitation, but as of reporting no complaint had been filed and no criminal investigation was under way. Police described cybercrime as a "criminal supply chain."
Three things: when GIANT and MARTIN'S digital platforms come back; whether the company files a formal complaint and whether anyone is attributed; and how the disclosure plays out — under SEC rules, public companies must report material cybersecurity incidents within four business days, and the parent filed a brief notice to Euronext Amsterdam on Tuesday.