Following its November 2024 cyber attack disclosure, Ahold Delhaize, one of the world’s largest retail food chains, has now confirmed that customer data was accessed during the incident. The company is notifying 2.2 million individuals that their personal, financial, and in some cases even health data was stolen.
The breach occurred on November 5, 2024, and was detected the next day. However, the company is yet to comment on any technical aspect related to the attack. In a filing with the Maine Attorney General’s office, the breach is simply described as an “external system breach (hacking)” that affected 2,242,521 individuals.
As is usually the case in such breaches, the exact information stolen varies from person to person. According to a sample copy of the letter being sent to affected individuals, the following data was stolen:
- Full names and birthdays
- Contact information, including physical and email addresses, as well as phone numbers
- Government-issued ID numbers such as Social Security, passport, and driver’s license
- Financial account information
- Health information, such as workers’ compensation data and medical information from employment records
- Employment-related information
Affected individuals are also getting two years of credit protection services from Experian as detailed in the notification letter. However, aside from keeping a keen eye on your credit score and online accounts, there’s not much that affected individuals can do in such breaches. If you were affected during the breach, it’s recommended that you change all your critical credentials and update payment information as soon as possible.
The company has yet to name the threat actor behind the hack. BleepingComputer reports that the INC Ransom group added the company to its dark web list of victims in April, leaking some documents allegedly stolen during the breach. When asked for confirmation, Ahold Delhaize did not comment.
In the News: Alaska Airlines subsidiary hit by cyber attack
