Food Lion (Ahold Delhaize)

Same November 2024 Ahold Delhaize breach as Giant Food - one parent company, one incident, 2.2 million people, recorded as a single connected finding rather than two. Food Lion's footprint skews toward smaller and more rural Southeastern and Mid-Atlantic markets, where it is frequently the only full-service grocery within reasonable distance. That matters for the same reason it did in the rural hospital and rural ISP rows: the market response a consumer is supposed to have available - shop elsewhere - does not exist.

• Severity
• Evidence tierUnassigned
• Claims confirmed
• Last verified2026-08-04

Primary source. www.cybersecuritydive.com/news/ahold-delhaize-usa-cyberattack-grocery-personal-data-exposed/751971/ — Verified - primary source confirmed.

Arbitration

Not independently confirmed this pass — standard binding arbitration + class action waiver expected; plaintiff firms (e.g., Woods Lonergan PLLC) announced investigations of EMPLOYEE claims; whether any class action is proceeding was not verified as of Oct 2026 given the employee-majority nature of the exposed population.

Data sharing

SAME 2024 AHOLD DELHAIZE BREACH as Giant Food (see that row) — Food Lion (headquartered in Salisbury, NC, founded 1957, owned by Belgium's Delhaize Group since 1974 and part of Ahold Delhaize since the 2016 Ahold-Delhaize merger) operates 1,100+ stores across 10 Southeastern/Mid-Atlantic states with 82,000+ employees, making it one of the LARGEST individual banners affected by the shared 2.2-million-person breach. A reported figure of 387,000+ affected North Carolina residents could not be verified this pass. One named plaintiff in the resulting litigation alleges his stolen data was 'subsequently published and sold on the dark web.'

Contacts

Privacy contact. Not recorded.

Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.

Mailing address. Not recorded.