Food Lion workers, families among 2.2M victims of latest corporate data breach
Another North Carolina business is part of a big data breach. This one involves Food Lion’s parent company, affects over 2.2 million people and already is the subject of a potential class action lawsuit in federal court.
Ahold Delhaize USA has begun notifying people affected by the data breach last fall, according to a notice on the North Carolina grocer’s website posted last Thursday.
Ahold’s subsidiaries including Salisbury-based Food Lion, Giant, Hannaford, Stop & Shop, ADUSA Distribution and ADUSA Transportation were affected by the security breach, according to the company.
The majority of people affected are employees and former employees, as well as dependents and beneficiaries, according to a company notice from late June. Personal information potentially compromised includes: contact information; birth dates; Social Security, passport and driver’s license numbers; and financial account and health information.
Among the victims are 387,071 North Carolina residents, according to the company’s security breach report sent to N.C. Attorney General Jeff Jackson’s office. The office shared it Monday with The Charlotte Observer.
It’s the third time in the past month that a big company in the Charlotte region acknowledged being hit by a large data breach.
In a statement to the Observer Monday, Ahold Delhaize said it is reviewing the impacted files to understand the scope of information involved in the incident and is taking action to protect its systems.
Food Lion referred to Ahold Delhaize for comment.
About Ahold and Food Lion’s data breach
The data breach occurred between Nov. 5-6, according to Ahold’s notice. The company detected unauthorized third-party access to internal U.S. business systems on Nov. 6.
On June 26, Ahold publicly disclosed information about the data breach, including on Food Lion’s website.
“We began taking steps to assess and contain the issue, including working with external cybersecurity experts to investigate and secure the affected systems,” the company stated in a data breach notification letter dated June 26 to the people affected.
Ahold is offering complimentary credit monitoring and identity protection services for two years.
“We believe the unauthorized third party’s access to our systems has been contained,” the company notice states. “We have no indication that customer payment or pharmacy systems were compromised in connection with the issue.”
Lawsuit filed over data breach
A federal lawsuit was filed Friday by Joshua Henderson of Virginia against Ahold Delhaize USA, Food Lion and Giant Food for the data breach.
The plaintiff is seeking class-action certification and a jury trial, according to the lawsuit filed in U.S. District Court for the Middle District of North Carolina. Henderson is a former employee of the defendants, according to the lawsuit. It does not say where he worked.
Ahold and Food Lion did not encrypt or properly secure sensitive data, failed to implement industry-standard cybersecurity measures and delayed notification to affected individuals, according to the lawsuit.
Henderson believes his private information, and others, was “subsequently published and sold on the dark web,” the lawsuit said.
About Food Lion and Ahold
Food Lion, based in Salisbury since 1957, was sold to Ahold in 2016.
Food Lion has more than 1,100 stores in 10 Southeastern and Mid-Atlantic states, and over 82,000 employees.
Food Lion consistently ranks third by market share in the Charlotte region behind Walmart and Harris Teeter, respectively. Food Lion saw $1.5 billion in sales last year, according to sales tracking firm Chain Store Guide.
Krispy Kreme, Belk data breaches
On June 16, Krispy Kreme began notifying over 160,000 people affected by a November data breach. More than a dozen lawsuits have been filed since against the doughnut giant.
Belk was affected by a data breach in May, according to several lawsuits that have since been filed in federal court.
The Charlotte Observer reported on the system failure last month. However, the Charlotte-based department store did not return requests for comment and has not yet made a public notification about the incident.
This story was originally published July 1, 2025 at 5:40 AM.
