Desk live·
ForensicPost
Breaches/Retail/File 25-0615

Ahold Delhaize USA Targeted as Parent of Giant and Food Lion

Ahold Delhaize USA, parent of Giant and Food Lion, was among the organisations targeted. Shoppers know the fascia; the data sits with a company most of them cannot name.

Constructed geometry · not a chart of case data
TargetAhold Delhaize USA
ActorScattered Spider
D. Kennedy11 min readConfidence: medium2 sources reviewed

Ahold Delhaize USA, which operates the Giant and Food Lion grocery chains among others, was among the organisations targeted during the 2025 campaign.

The Gap Between The Brand And The Holder

A shopper has a relationship with Food Lion. Their loyalty record, payment history and contact details sit with a corporate parent whose name does not appear on the store.

The corpus filed the same structure at 25-0710, where three LVMH brands disclosed separately, and observed that the pattern exists only above the level anyone reports. Here it runs the other way: one holder, several consumer-facing names, and a notification arriving from an entity the recipient may not recognise as connected to the shop.

Loyalty Data Again

This desk argued at 25-0501, after all 6.5 million Co-op members were taken, that a loyalty scheme is not a marketing add-on — it is the mechanism by which an anonymous shopper becomes an identified one, and completeness is the entire product.

Grocery loyalty data is the most revealing consumer dataset in this corpus after health records: it describes household composition, dietary and medical needs inferable from purchases, income level, and routine. The order-history argument at 25-1130 applies with a longer history behind it.

And Retail Was Worked At Both Ends Of The Year

UK retail in April and May at 25-0430, 25-0501 and 25-0929. US retail from late May, per the rotation at 25-0512. Grocery in June.

Graded medium: the targeting is as reported, and this desk has not established what data was reached or whether any customer records were affected.

How we reported this

Compiled from published reporting, listed below. The extent of any data access is not established. Corrections: corrections@forensicpost.com.

Sources
  1. Scattered Spider targets Aflac, other insurance companiesSecurity Boulevard
  2. June 2025 data breach round-upFindings
D. Kennedy
Identity and access reporter. Former DFIR consultant. Signal on request.
// the chain of custody — tuesdays

Get the next file first.

One incident a week, taken apart properly. Logs, timelines, and what the filing left out.

PGP-signed edition · no tracking pixels · one-click unsubscribe
© 2026 ForensicPost Media · the desk · newsletter · searchGlossary