One of the world’s largest food retail ranges, AHold Delhaize, is informing more than 2.2 million individuals that their personal, financial and health information was stolen in the November ransomware attack that affected its American systems.
Multinational retailers and wholesale companies operate over 9,400 local stores throughout Europe, United States and Indonesia, employ over 393,000 people and serve around 60 million customers each week.
It has reported a net sale of over $ 104 billion last year and is operated in the American market under several brands including Food Lion, Stop and Shop, Giant Food, and Hannford, and Hannford, and Delhise, Maxi, Mega Image, Albert, Bol, Alpha Beta Beta and Gall and Poi.
“This issue and later mitigation actions have affected some Ehold Delhis USA brands and services, including many pharmacies and some e-commerce operations,” Ahold delhaize said In November, when it revealed the incident.
In one Thursday Admission Along with the Attorney General of the Main, the retail legend revealed that the attackers stole the data of 2,242,521 persons after the violation of November on November 6, 2024 after reaching the company’s internal American trade systems.
Although it did not confirm whether the customers’ information was also affected or not, Ehold Delhiz said that the stolen files may include internal employment records with personal information obtained while working with the current and former EHILD DALHIS USA companies.
The company said that stolen items differ for each affected person and there is a combination in stolen documents:
- Personal information such as name, contact information (eg, postal and email address and telephone number), date of birth, identity number issued by the government (eg, social security, passport, and driver’s license number),,
- Financial account information (eg, bank account number),
- Health information (eg, compensation information of workers and medical information contained in employment records),
- And information related to employment.
Although the company has not yet received the name of the Cybercrime Group behind Breach, Ink Rancem Rancemware Group added EHILD Dalehiz in its Dark Web Extortion portal in April, leaked samples of documents allegedly stolen from the company’s compromise systems.

When asked that Ink was behind the ransom attack, Ehold Dalhaiz told BlappingCoper in April that the attackers had stolen data from their American trade systems, but did not comment whether the Rainsmware gang was involved in the gang breech.
Ink Rancem is a Rainmary-e-A-Sarvis (RAAS) operation which came out in July 2023 and has since been the target organizations in both public and private sectors.
The list of over 250 victims claimed over the last two years includes government, healthcare, educational and industrial institutions, such as the National Health Service (NHS) of Scotland, Yamaha Motor Philippines and the US Division of Zerox Business Solutions (XBS).
In April, the Rainmware Gang also claimed responsibility for the attack on the State Bar of Texas, which later warned over 100,000 members that hackers had stolen their sensitive data.
Ink Rancem has recently focused on organizations in the United States, with a member of it, has been tracked by Microsoft as ‘Vanilla Tempest’, especially the US healthcare providers.