Koninklijke Ahold Delhaize N.V. Listed by incransom Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 16 April 2025, the ransomware group incransom publicly listed Koninklijke Ahold Delhaize N.V. as a victim, claiming it had exfiltrated internal files and would soon publish 6TB of sensitive data. The number of people whose information may be involved remains unknown. For customers, employees and partners of a company that serves tens of millions of shoppers weekly across multiple continents, the practical stakes are straightforward: any personal or operational data that ends up in the wrong hands can be used for fraud, identity misuse or further targeting, and the full extent of exposure is still unconfirmed.

Public detail is limited to the group's own leak-site claim. No independent confirmation of the volume, exact contents or successful publication has been provided in the available record, so those whose details may have been held by the organisation are left to weigh the risk carefully rather than assume the worst.

Inside the incident

According to the listing dated 16 April 2025, incransom asserted that Ahold Delhaize had become a victim of what the group called its largest data breach to date. The group stated that internal files had been exfiltrated in a ransomware attack and that 6TB of sensitive data would be published soon on its blog. No further technical details—such as the initial access method, the precise date of intrusion, encryption of systems, or any ransom demand—have been disclosed in the public record. The number of people affected is listed as unknown. The claim itself remains an unverified assertion by the threat actor.

The group behind it: incransom

Incransom is a ransomware operation that follows the now-common double-extortion model: after gaining access to a network, operators encrypt systems and simultaneously steal data, then threaten to leak the material if a ransom is not paid. Like other groups in this category, it maintains a public leak site where it names victims and posts samples or full archives once deadlines pass. The group has been observed targeting a range of sectors, often advertising large data volumes to increase pressure. In this case the listing simply names Koninklijke Ahold Delhaize N.V. and asserts the 6TB figure; no additional statements specific to the company beyond that claim appear in the available facts. As with all such postings, the assertions should be treated as claims until independently verified.

About Koninklijke Ahold Delhaize N.V.

Koninklijke Ahold Delhaize N.V. is a major international food retail group headquartered in the Netherlands. Its family of supermarket and grocery brands operates across the United States, Europe and Indonesia, serving approximately 72 million customers every week. The company emphasises everyday food retail, value and workplace opportunities. Organisations of this scale routinely hold customer loyalty and transaction records, employee personal and payroll data, supplier contracts, and internal operational documents. A breach claim against such a retailer is consequential because the volume of individuals and commercial partners potentially touched by its systems is large, and retail data can be reused for phishing, account takeover or competitive intelligence.

The information in question

The only data type named in the available record is “internal files exfiltrated in ransomware attack.” The group further claimed that 6TB of sensitive data would be published. Exact contents—whether customer records, employee files, financial documents or other categories—are not disclosed. Retail groups of this kind typically maintain customer contact and purchase histories, staff HR information, and proprietary business files; however, it is not confirmed that any of those specific categories were among the material taken. Public detail on what was actually copied remains limited to the actor’s general description.

What's at stake

For individuals, the concrete risks include the possibility that personal identifiers, contact details or financial information could later appear in criminal markets and be used for social-engineering attacks or fraudulent accounts. For the organisation, the stakes involve potential regulatory scrutiny, customer trust erosion, and the operational cost of investigating and containing the incident. Because the number of people affected is unknown and the precise data types unconfirmed, the real-world impact cannot yet be quantified; the prudent course is to treat the claim as a credible warning rather than proven mass exposure.

If your data was in this claimed breach

If you are a customer, employee or partner of Ahold Delhaize brands, practical first steps remain the same regardless of confirmation status:

• Monitor financial and loyalty accounts for unexpected activity and enable multi-factor authentication where available.
• Be alert to phishing emails or calls that reference the company or recent shopping history.
• Consider placing a fraud alert or credit freeze if you believe sensitive personal data may have been involved.
• Change passwords on any accounts that reuse credentials linked to the retailer.

Readers can also run a free exposure scan of their email address to check whether their information has already surfaced in known breach data sets. Until more verified detail emerges, these measures offer the most direct protection.

AICompiled with AI assistance from public sources and published under our editorial standards.