Giant Food (Ahold Delhaize)

This is the most directly regional finding in the tracker: Ahold Delhaize USA - parent of Giant Food, Food Lion, Hannaford and Stop & Shop - confirmed a November 2024 ransomware attack affecting over 2.2 million people, with the INC Ransom group claiming more than 6 terabytes exfiltrated. The exposed data included Social Security numbers, PASSPORT numbers, driver's licence numbers and financial and health information - and those affected included current and former EMPLOYEES, dependents and beneficiaries, not only shoppers. Giant is one of the dominant grocery chains across DC, Maryland and Virginia, which means a very large number of Mid-Atlantic households are connected to this breach through a family member's job rather than through their weekly shop.

• Severity
• Evidence tierUnassigned
• Claims confirmed
• Last verified2026-08-04

Primary source. www.cybersecuritydive.com/news/ahold-delhaize-usa-cyberattack-grocery-personal-data-exposed/751971/ — Verified - primary source confirmed.

Arbitration

Not independently confirmed this pass — standard binding arbitration + class action waiver expected for customer-facing disputes; the breach litigation is primarily EMPLOYEE-driven (Ahold Delhaize employee class action, see Food Lion row for shared parent-company details).

Data sharing

MASSIVE, DIRECTLY REGIONAL BREACH (Nov 2024, still generating litigation in 2026): Giant Food's parent company Ahold Delhaize USA (also owner of Food Lion, Hannaford, and Stop & Shop) confirmed a ransomware attack (INC Ransom group, claiming 6+ TERABYTES exfiltrated) affecting OVER 2.2 MILLION individuals — including current/former EMPLOYEES, their dependents, and beneficiaries, not only shoppers. Exposed data included contact information, birth dates, Social Security numbers, PASSPORT numbers, driver's license numbers, and financial/HEALTH information. The attack forced Giant Food's e-commerce and business systems offline temporarily. Ahold Delhaize is offering 2 years of free credit monitoring/identity protection to affected individuals.

Contacts

Privacy contact. Not recorded.

Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.

Mailing address. Not recorded.