By Gary S. Miliefsky, Publisher of Cyber Defense Magazine
Introduction
In late 2024, cybercriminals breached Ahold Delhaize USA Services, LLC, exposing the personal data of millions of current and former employees of major grocery chains including Food Lion, Stop & Shop, Giant, Hannaford, and Peapod. The attackers, a ransomware group known as INC Ransom, claimed responsibility and released proof of the stolen data online. The stolen information included names, contact details, Social Security numbers, bank accounts, driver’s license numbers, and in some cases, employment and medical records.
Scope of The Incident
This is a very significant supply chain breach. The parent company owns 8k stores across US and Europe, Employs 410k people and has 110 billion in annual revenue. The Ahold Delhaize USA Services, LLC division manages H.R. and Payroll for the US brands including:
- Food Lion
- Hannaford
- Stop & Shop
- Giant
- Peapod
With stores in 20 U.S. states, and millions of shoppers, employees and their families potentially affected. So far, it is not known to directly affect shopper payment information, but the breach does include many employees:
- Full names
- Contact details
- Social Security numbers
- Driver’s license info
- Bank account data
- Medical and employment records
…which is significant and valuable on the dark web.
How It Probably Started: A Single Phishing Email
Based on patterns observed in similar cyber criminal group attacks, it is highly likely that this incident began with a phishing email; an email disguised to look legitimate but containing a malicious link or file. An unsuspecting employee clicked the link or opened the attachment, giving the attackers remote access to Ahold Delhaize USA Services’ internal network.
Once inside, attackers may have escalated privileges, moved laterally, and accessed a sensitive file repository. The breach went undetected long enough for personal data to be exfiltrated and most likely used for ransom extortion.
The Ransomware Group Behind It: INC Ransom
INC Ransom is a cybercriminal group that targets large organizations and publishes stolen data on leak sites. Their methods typically include:
- Phishing and social engineering
- Lateral movement within internal systems
- Data exfiltration prior to encryption
- Ransom demands with threats of public data exposure
Why Anti-Phishing Technology and Training Matter
Breaches like this underscore the importance of defending against phishing, the most common initial attack vector. Organizations must deploy:
- Advanced email security platforms with phishing detection
- Real-time URL and attachment scanning
- Regular cybersecurity awareness training for all employees
- Simulated phishing campaigns to test readiness
- Zero Trust network architecture
- Endpoint detection and response (EDR) systems
What You Can Do if You Were Affected
Ahold Delhaize is offering two years of free credit monitoring and identity protection through Experian. To enroll:
- Visit: https://www.experianidworks.com/plus
- Use activation code: RJ24TC2F8D
- Enroll by: September 30, 2025, at 11:59 p.m. UTC
The service includes:
- Credit monitoring for all three credit bureaus
- Identity theft insurance
- Fraud resolution assistance
- Alerts for suspicious activity
You should also:
- Place a credit freeze with Equifax, Experian, and TransUnion
- Use strong, unique passwords for all accounts
- Be cautious with emails and messages regarding the breach
- Monitor your credit and bank accounts regularly
- Report identity theft at https://www.identitytheft.gov
What Shoppers Should Do
Even if you were not an employee, follow these consumer cybersecurity best practices:
- Use credit cards or cash instead of debit cards
- Avoid clicking on suspicious promotional emails
- Use strong and unique passwords for your store loyalty and app accounts
- Enable two-factor authentication where available
- Monitor credit reports and bank statements for unusual activity
Note: Credit cards offer better fraud protection and do not directly withdraw funds, while debit card fraud can freeze your actual money for days or weeks and you have to fight for your lost money.
Final Thoughts: Prevention Starts with People
This supply chain H.R records breach was likely the result of a single human mistake; a single click. That makes it a powerful reminder: cybersecurity is everyone’s responsibility. Employees need training. Companies need layered defenses. Consumers must stay alert.
To stay informed and protect yourself, subscribe: https://www.cyberdefensemagazine.com/free-subscription/
About the Author
Gary Miliefsky is the publisher of Cyber Defense Magazine and a renowned cybersecurity expert, entrepreneur, and keynote speaker. As the founder and CEO of Cyber Defense Media Group, he has significantly influenced the cybersecurity landscape. With decades of experience, Gary is a founding member of the U.S. Department of Homeland Security, a National Information Security Group member, and an active adviser to government and private sector organizations. His insights have been featured in Forbes, CNBC, and The Wall Street Journal, as well as on CNN, Fox News, ABC, NBC, and international media outlets, making him a trusted authority on advanced cyber threats and innovative defense strategies. Gary’s dedication to cybersecurity extends to educating the public, operating a scholarship program for young women in cybersecurity, and investing in and developing cutting-edge technologies to protect against evolving cyber risks. Logos and content in this article are for educational and news purposes, used under fair use of us copyright laws.