If you’ve tried to open the Food Lion app or website this week and gotten nothing but an outage notice, you’re not alone, and it’s not your phone. Food Lion — headquartered right here in Salisbury, North Carolina — and its sister chains have had their websites and apps offline since Monday after their parent company detected a cybersecurity incident.

Here’s what’s confirmed, what isn’t, what it means for you as a shopper, and the scams you should expect to see in the next few weeks. Then, for the business owners who read this blog, a few lessons in how a large company handled the first days of an incident — because some of it is worth copying.

What’s confirmed

• The parent company is Ahold Delhaize, a Netherlands-based grocery group that owns Food Lion, Giant Food, The Giant Company, Stop & Shop, and Hannaford in the U.S.
• The incident began the evening of Sunday, October 11. On Monday the company said it was experiencing a security issue within its network and had taken some systems offline as a precaution “to help protect them.”
• Websites and apps for all five U.S. chains went down, along with several of the company’s European brands.
• Stores, pharmacies, and fuel stations remain open for normal hours.
• Online ordering is suspended. The chains say unfulfilled orders placed through their own sites will be refunded, and delivery is still available through Instacart, DoorDash, and Uber Eats.
• Personalized digital offers are affected. Reporting indicates app-linked and loyalty-based savings have been paused. Food Lion says customers can still access additional coupons and offers through in-store kiosks.
• Recovery is underway. On Tuesday the company said it had begun “a controlled relaunch of certain systems,” while continuing to investigate. As of Wednesday, Food Lion’s site was still showing an outage notice, and no restoration date has been announced.

What we don’t know yet

The company hasn’t said what kind of incident this is, how it started, or who is behind it, and as of this writing no group has publicly claimed it. On the question everyone asks first, Ahold Delhaize said Tuesday: “Although our investigation is still ongoing, we have no evidence at this moment that customer, associate and partner data was taken in this cybersecurity incident.”

Two things worth knowing about that statement. First, it’s genuinely good news, and it’s carefully worded: “no evidence at this moment” is honest, and it leaves room for the investigation to find otherwise. Second, there’s history here. In November 2024, the same company dealt with an incident that took systems offline, disrupted pharmacies and online ordering, and left some Stop & Shop shelves thin before Thanksgiving. Months later, the company confirmed that files had been taken and notified more than 2.2 million people whose information was in employment-related records. That doesn’t mean this incident will go the same way. It does mean it’s reasonable to keep an eye out over the coming months.

One more clarification, because you may see it suggested online. This incident began the same Sunday night that attackers hit refrigeration systems at hundreds of supermarkets in France, which we wrote about Monday. According to reporting, the Netherlands’ national cybersecurity center said it did not believe the two were connected, and no evidence linking them has been made public. The timing is a coincidence until someone shows otherwise.

What this means for you as a shopper

• You can still shop, fill prescriptions, and buy gas in person. The stores are open.
• If you had an online order that wasn’t filled, the chains say it will be refunded. You shouldn’t need to do anything special or provide your card details again to get it.
• Personalized digital coupons may not apply right now. At Food Lion, the in-store kiosks are the workaround.
• If you used the same password for your grocery app that you use anywhere else, change it on those other accounts now, and on the grocery app once it’s back. There’s no evidence passwords were taken, but reused passwords are the most common way one incident turns into several.

The scams to expect

This is the part we most want you to share. Every widely reported outage is followed, within days, by scammers impersonating the affected company — and a grocery chain that millions of people use every week is an ideal costume. Expect messages like these:

• “Your refund is ready — confirm your card details.” Real refunds go back to the original payment method. Nobody legitimate needs your card number to send your money back.
• “Restore your rewards” or “re-verify your account.” Links to fake login pages built to collect your password.
• “We’re sorry — here’s a $100 gift card for your trouble.” Fake apology giveaways spread fast on social media. They lead to surveys that harvest your information or ask for a “small shipping fee.”
• Calls from the “fraud department.” A caller claiming your account was affected and asking you to verify your identity or move money.
• Fake apps and lookalike websites claiming to be the “restored” version of the app.

The one rule that beats all of these: don’t act on any message about this outage that arrives by text, email, call, or social media post. When the app is back, open it from your phone’s official app store or type the website address yourself. If the company ever needs to tell you something important about your data, it will say so in an official notice — and in the 2024 incident, those notices arrived as formal letters, months later. Nothing legitimate about this needs a link clicked today.

We made the same point about the ASUS store breach last month: once a company is in the news, its name becomes the scammer’s best tool. Please pass this part along to parents, grandparents, and anyone who does their grocery shopping on an app.

What business owners should take from this

Whatever turns out to have caused this, the first few days are a useful case study in incident response. Here’s what we’d point to.

They pulled the plug quickly

The issue started Sunday evening, and by Monday morning the company had taken its websites and apps offline as a precaution. Shutting down digital sales for five grocery chains is an expensive decision, and making it fast is the right instinct. Compare that with the Berlin government attack we covered last month, where reporting described about a week between the first warning sign and isolation. Isolation hurts. Delay usually hurts more, because an intruder who’s still connected keeps working.

One shared network, many brands

A single incident inside one parent company took down the digital front doors of five separate U.S. grocery chains and several European ones at the same time. That’s what shared infrastructure does: it’s efficient every day, and it’s a single point of failure on the bad one. A small business has a version of this too — several locations on one account, one platform running booking and payments and email, one login that reaches everything. Sharing is often the right choice. It’s worth knowing, deliberately, what goes down together.

The business kept running

This is the part most worth copying. With its own digital channels dark, the company kept stores, pharmacies, and fuel stations open, pointed customers to third-party delivery services, refunded orders it couldn’t fill, and offered coupons through in-store kiosks. Customers could still buy groceries. That’s business continuity working — a set of fallbacks that let the core business keep operating while the systems are rebuilt.

Ask the same question about your own business: if your website, booking system, or point-of-sale went dark tomorrow, how would customers still reach you, pay you, and get what they came for? We made a version of this argument about backups and recovery, but continuity is broader than restoring files. It’s the phone number customers can still call, the paper process for taking orders, the backup way to accept payment, and the message you’d post to tell people what to do.

They told people what to do

The outage notices on each chain’s site did three useful things: said what was affected, said what still worked, and told customers what to do instead. The company also updated its statement on Tuesday rather than going silent. Clear, practical communication doesn’t fix an incident, but it keeps customers from filling the silence with rumors — and from falling for the scammers who will try to fill it for them.

Twice in two years

This is the company’s second significant incident in under two years. Large retailers are attractive targets and they get targeted repeatedly. The lesson for any business that’s already had a scare is the same: the incident isn’t over when the systems come back. It’s over when you’ve closed the way in and you’re ready for the next attempt.

What to do this week

As a shopper: shop in person if the app’s still down, ignore any message about this outage that arrives with a link, change any password you reused, and warn the people in your life who shop online.

As a business owner:

1. Decide in advance who can pull the plug. Who’s allowed to take your systems offline if something looks wrong, and how do they do it? Making that call fast depends on having made it ahead of time.
2. Write down your fallbacks. How you’d take orders, accept payment, and reach customers if your main systems were unavailable for a week.
3. Know what goes down together. Which locations, services, and accounts share a single platform or login.
4. Draft your outage notice now. What’s affected, what still works, what customers should do, and a warning not to trust messages claiming to be from you.

Worth asking about your own business: If your website or booking system went down tonight, could customers still reach you and pay you tomorrow? * Who has the authority to take systems offline, and do they know it? * Which of your locations or services would all go down together? * And do you have a message ready to tell customers what to do — and what not to trust?

The takeaway

For North Carolina shoppers, the practical message is simple: the stores are open, unfilled online orders are being refunded, and the biggest risk right now is the scam messages that will ride on this news. Don’t click; go to the source yourself.

For business owners, it’s a look at incident response done at scale: isolate quickly, keep the core business running through fallbacks, and tell customers clearly what’s happening. Most small businesses have never written down any of those three things. Our environment review is where that starts: we look at what your business depends on, what would go down together, how quickly you could isolate a problem, and what your fallback looks like when the technology isn’t there. A grocery giant can absorb a week without its website. The goal is making sure your business could too.

Sources: Ahold Delhaize statements (October 12 and 13, 2026); Grocery Dive; The Banner; Fox Business; The Philadelphia Inquirer; Supermarket News; LancasterOnline, October 2026. Ahold Delhaize has not disclosed the nature or cause of the incident, and no group has publicly claimed responsibility as of publication. Reporting indicates the Dutch National Cyber Security Centre does not believe the incident is connected to the concurrent attack on French supermarkets. Details of the November 2024 incident are drawn from the company’s breach notifications and contemporaneous reporting.