Koninklijke Ahold Delhaize N.V. targeted by Inc Ransom in alleged data breach

• Ransomware group: Inc Ransom
• Country: Netherlands
• Sector: Agriculture and Food Production
• Announcement date: April 16, 2025

Inc Ransom claims a massive data breach at Koninklijke Ahold Delhaize N.V.

The ransomware group known as Inc Ransom has officially listed the international retail and food group Koninklijke Ahold Delhaize N.V. on its leak site. According to the group's announcement, they claim to have successfully exfiltrated a significant volume of sensitive information, totaling approximately 6 TB of data. This development marks a major escalation in the ongoing pressure applied by the threat actor against the organization.

The announcement, which appeared on the group's leak site on April 16, 2025, serves as a public declaration of the alleged theft. While the group has claimed responsibility for the breach, the claims remain unverified. This type of public listing is a hallmark of modern ransomware operations, where threat actors use the threat of data exposure to exert maximum pressure on their targets.

Details of the alleged attack and stolen data

The incident was announced on April 16, 2025, the same day the group claims the attack occurred. In their public post, Inc Ransom alleged that they have obtained 6 TB of sensitive data belonging to the organization. To support their claims and demonstrate the validity of the breach, the group has released several document samples. These samples are purportedly related to the internal operations and the personnel of the company.

Based on the screenshots provided by the attackers, the stolen information appears to include a variety of sensitive materials. The leaked content is reported to contain:

• Employee identification data
• Corporate contracts
• Internal correspondence

The presence of identification card samples and internal communications suggests that the breach may have targeted both corporate and individual privacy. Such a variety of data types indicates a broad scope of access during the alleged intrusion.

About Koninklijke Ahold Delhaize N.V.

Koninklijke Ahold Delhaize N.V. is a major international retail and food group with a massive global footprint. The company operates extensively across the United States, Europe, and Indonesia. By managing a diverse portfolio of supermarket chains, the organization serves millions of customers on a daily basis, making it a critical player in the global food production and retail sector.

Analysis and potential risks of the incident

Given the immense operational scale and the vast customer base of Koninklijke Ahold Delhaize N.V., this incident poses significant risks regarding the privacy of personal data. The potential publication of stolen information could lead to serious compliance issues under the General Data Protection Regulation (GDPR) across the European Union. Because the organization operates in multiple jurisdictions, the regulatory implications of such a breach are complex and far-reaching.

Inc Ransom, a group that emerged in mid-2023, is known for employing double extortion tactics. In a double extortion scenario, attackers not only encrypt an organization's systems to disrupt operations but also steal sensitive data to use as leverage. By threatening to release the data publicly, the group attempts to force the organization into paying a ransom to prevent the exposure of its proprietary and personal information.

For the customers residing in the regions where the organization operates, this breach introduces secondary risks. Specifically, the exposure of employee and corporate data can lead to increased instances of identity theft and targeted phishing attacks. Such attacks often leverage the stolen information to gain further access to systems or to defraud individuals.

In response to such threats, organizations in the food and retail sectors typically focus on strengthening their defensive posture. This includes implementing robust data encryption, enhancing monitoring for unauthorized data exfiltration, and maintaining strict access controls. Furthermore, maintaining a comprehensive incident response plan is essential for managing the legal and reputational fallout that follows a public data leak announcement.