The parent company of GIANT — the Carlisle, Pennsylvania-based grocery chain that most York County residents shop at every week — was hit by a cyberattack this week that knocked websites and apps offline for GIANT, Stop & Shop, Food Lion, Hannaford and Giant Food. Stores stayed open, but the digital side of the business was crippled for days. For small-business owners in York County, this is a clear preview of what a 'minor' security incident actually costs — and what your IT provider should already be doing to make sure it doesn't happen to you.
What happened
Ahold Delhaize, the food retail group based in Zaandam, the Netherlands, said on October 12, 2026 that it had taken some systems offline after identifying a security issue within its network. The GIANT Company, Giant Food, Food Lion, Hannaford, and Stop & Shop websites went down on October 12, 2026, with physical locations still serving customers but online ordering and deliveries disrupted.
By mid-week, the outage was still in effect. As of Thursday morning, a visit to the GIANT website was met with a static image noting that the app and website are down and any orders placed through them would be refunded. Delivery orders could still be placed through Instacart, DoorDash, and Uber Eats, and GIANT stores, pharmacies and fuel stations remained open during normal business hours.
Ahold Delhaize has not confirmed a data breach in its October 12, 2026 public statement — the company said it was responding to a security issue within its network and did not identify a data exposure. That's an important distinction, but it doesn't mean a breach is ruled out — investigations like this often take weeks.
Why a small business should care
You might read this and think: 'I'm not a multinational grocery chain. This doesn't apply to me.' It absolutely does.
The part of Ahold Delhaize's business that went down wasn't the cash registers — it was the digital infrastructure that modern operations depend on: online ordering, scheduling, customer-facing apps. The incident impacted operations across multiple brands including Stop & Shop, Albert Heijn, Food Lion, and Delhaize, affecting employee access to scheduling systems and customer-facing platforms including websites, mobile apps, and online ordering services. If your small business runs on a scheduling tool, an online booking page, a point-of-sale, or a customer portal, that is the exact attack surface being targeted.
And this is the second time in two years for the same company. The multinational retailer's second major cybersecurity incident in two years highlights critical vulnerabilities in retail infrastructure. If a company with a nine-figure IT budget can be hit twice, a 15-person office with one person who 'handles computers' on the side is a much easier target.
What your managed-IT provider should be doing about this
A properly run IT program treats an incident like this as a checklist review, not a news story. Here's what should already be in place:
- **Network segmentation.** When one system gets compromised, it shouldn't be able to reach every other system. Attackers typically gain initial access through network infiltration or credential compromise, escalate privileges within corporate systems, and move laterally. Segmentation is what stops that lateral movement. - **Tested, offline backups.** The reason Ahold Delhaize was able to take systems offline as a protective measure is because they had the ability to isolate and (presumably) restore. Your backups need to be tested on a schedule — not assumed to work. - **Multi-factor authentication everywhere.** Especially on email, remote access, and any admin account. This is the single highest-ROI control a small business can deploy. - **A written incident response plan.** One page is fine. Who calls who, what gets unplugged, what the vendor list looks like. If you don't have this, your first hour of a breach will be chaos. - **24/7 monitoring.** Attacks don't wait for business hours. If your current setup only looks at logs during the workday, you have a 16-hour window every night where an attacker can operate undisturbed.
If you already have an internal IT person and want backup on the security side, that's exactly what co-managed IT support is for. If you have no one, that's what a full managed-IT program is for. Either way, the controls above aren't optional anymore.
What York Businesses Should Do
GIANT is headquartered in Carlisle, less than an hour from York, and most York County small businesses either shop there, deliver to them, or compete with them for staff. Use this week as the prompt to ask your IT provider three questions: when was our last backup restore test, is MFA on every account, and what's our written response plan if we get hit tomorrow?
Sources
- Ahold Delhaize Takes Systems Offline Following Cybersecurity Incident
- GIANT grocery stores website, app down due to cyberattack
- Ahold Delhaize Cyberattack Takes Giant, Food Lion, and Stop & Shop Websites Offline
- Ahold Delhaize Cybersecurity Incident: What We Know
- Ahold Delhaize Cyberattack 2026: Retail Giant Takes Systems Offline