A “cybersecurity issue” has left some Stop & Shop and Hannaford grocery stores in the Northeast with their shelves bare for nearly two weeks, just a week before the Thanksgiving holiday.
The grocery stores’ parent company, Ahold Delhaize, of the Netherlands, said in a statement on Nov. 8 that it was experiencing a “cybersecurity issue within its U.S. network,” which resulted in product shortages at dozens of stores. Ahold Delhaize spokesperson Christy Phillips-Brown said in a statement that an investigation continues.
“Our teams are taking steps to assess and mitigate the issue,” the statement reads. “This includes taking some systems offline to help protect them. This issue and subsequent mitigating actions have affected certain Ahold Delhaize USA brands and services including a number of pharmacies and certain e-commerce operations.”
Stop & Shop has over 300 locations in five states, including New York, Massachusetts and Connecticut, and Hannaford has 189 locations in states such as Maine, Vermont and New Hampshire. Stop & Shop spokesperson Caroline Medeiros said that despite the limited number of products, Stop & Shop stores and pharmacies are still open and operating as the chain works to restock its shelves and anticipate item availability.
Stop & Shop did not specify which systems were down at the stores and what products were limited. There have been reports that products such as milk, cottage cheese and chicken breasts were out of stock at many stores. There have also been reports that the cybersecurity issue has affected some stores’ ability to accept debit or gift cards payments and that it has also restricted product deliveries.
Hannaford’s website was also down over the weekend and on Monday because of the issue, but Phillips-Brown said that it is now live and working and that the stores’ pickup and delivery options are available.
NBC News was able to identify at least 27 Stop & Shop locations that news outlets or users online cited were having issues putting out product, in Massachusetts, Connecticut, New York, Rhode Island and other states. Medeiros said Stop & Shop was not able to provide a number of the stores affected by the shortages and added that the availability of products has varied by store.
Nicole Cotton, a Boston resident who had recently gone to Stop & Shop, said that while she was there, she noticed that there were virtually no meat products. She added that the shelves were still mostly empty when her roommate went to the store Friday and when she went there herself Sunday. Cotton added that she also had a hard time scanning the deli meat she was buying.
“At my personal Stop & Shop, I noticed that there wasn’t a lot of chicken, ground turkey. There was ground beef,” Cotton said. “But there was also no produce, any vegetables — there was literally nothing. No carrots, no cucumbers. They had fruit and stuff, but nothing that was refrigerated.”
Stop & Shop shoppers took their complaints to social media. A user showed pictures on a Facebook from a Stop & Shop in Pittsfield, Massachusetts with rows of empty shelves and wrote “Avoid Stop and Shop… their shelves are empty.” A user on TikTok posted a video with over 40 thousand views of the empty shelves in a Stop & Shop in South Boston. Many in the comments of both posts said they had been confronted with similar scenes at other Stop & Shop locations.
Alan Liska, a ransomware analyst at the cybersecurity company Recorded Future, said the issues were consistent with a ransomware attack, in which hackers lock up a target company’s computer network and demand payment in cryptocurrency. Companies infected with ransomware can experience significant delays either booting out the hackers’ malicious software or pre-emptively taking computers offline to protect them.
“While we don’t have confirmation and no ransomware group has taken credit for it, the [Stop and Shop] attack has all the hallmarks of a ransomware attack: supply chain disruption, payment processing interrupted and general confusion,” Liska said.
Over the summer, the world’s largest meat supplier, JBS, was hit with a ransomware attack that resulted in its having to take some of its systems offline and halting some work shifts in North America and Australia. A similar attack on Colonial Pipeline, a major U.S. fuel supplier, resulted in shortages in gas stations as the company had to go offline for several days. The Russia-tied hackers were able to take $4.4 million in ransom from the company.
The cybersecurity issue comes at a vulnerable time for Stop & Shop, which announced over the summer that it would close dozens of its stores that were underperforming. And with Thanksgiving around the corner, the stores faced an additional challenge of being able to meet customers’ demands. However, Medeiros, the spokesperson, said the stores are on track to have Thanksgiving items available.
“Stop & Shop is well stocked with turkeys and hams for the upcoming Thanksgiving holiday, along with staples like potatoes, gravy, and stuffing,” she said. “Customers may see limited availability for some fresh items in certain store locations, however we’re working to restock those items and expect continuous improvement in all impacted stores in advance of the weekend. We’re grateful to our customers for their patience — and look forward to serving them for their holiday celebrations.”
