Ahold Delhaize USA Services, LLC Data Breach Notice (Oregon Attorney General)

The filing from Ahold Delhaize USA Services, LLC means that personal information belonging to more than 2.2 million people is now outside the company’s control. If you received a notification letter, some of your records were included in that exposure.

Personal information that cannot be replaced

The Oregon Attorney General’s record lists personal information as the category exposed. This typically includes name combined with Social Security number, date of birth, address, and other details that remain useful for identity theft years after the incident. Unlike a credit card, these pieces of information cannot be cancelled or reissued. Once they are out, they stay out.

That permanence is what makes this notice different from one that only involves payment cards. The people whose records were included now carry an elevated risk of fraud, tax-related identity theft, and loan fraud that can appear long after the filing date of June 26, 2025.

No passwords or credentials were exposed

The record contains no indication that passwords, login details, or any authentication credentials were involved. This is genuinely good news. You do not need to change any password connected to Ahold Delhaize, Stop & Shop, Food Lion, Hannaford, or any of its other brands because of this specific incident. The exposure is limited to the personal information fields that matter for identity crimes, not account takeover.

What the scale actually tells you

More than 2,242,521 individuals are named in this filing. That is the exact number printed beside this article. The company was required to notify Oregon residents, which means the breach touched a substantial portion of its customer base in the state. The letter you may have received is the only reliable way to know whether your specific records were part of it.

The filing does not state when the incident occurred, only that the notification reached the Oregon Department of Justice on June 26, 2025. Because no incident date is given, there is no way to apply a “have you moved since then” test. The letter itself is the check that matters. If you have not received one, it usually means you were not in the affected group. Anyone who has changed address since they last shopped at an affected banner should contact the company directly to confirm their status.

Why this exposure lasts for years

A name plus Social Security number is one of the most valuable combinations for criminals. It can be used to file fraudulent tax returns, open accounts in your name, or claim government benefits. Medical or insurance details sometimes appear in the same records even if the filing uses the broad term “personal information.” These details do not expire the way a stolen credit card does.

The absence of any mention of passwords means the immediate risk is not that someone will log into your loyalty account or order groceries on your card. The risk is that your identity itself becomes the product being traded or used in the background.

How to determine whether this affects you

The organisation is required to notify affected individuals directly, usually by mail. If you received a letter from Ahold Delhaize USA Services, LLC or one of its brands, assume your personal information was included. If no letter has arrived, your records were most likely not part of this filing. Because addresses can be outdated, anyone concerned should reach out to the company’s customer service using the contact information in the official notice rather than assuming safety.

Concrete steps that address this exact exposure

• Place a fraud alert or credit freeze with the three major credit bureaus. This is the single most effective action you can take today. It forces lenders to verify your identity before opening new accounts and works precisely against the type of personal information listed in the filing.
• Monitor your tax filings closely this year and next. Identity thieves often wait until tax season. File your return as early as possible and watch for IRS rejection notices that indicate someone else has already filed under your Social Security number.
• Review Explanation of Benefits statements from every health insurer you use. Even though the filing uses the general term “personal information,” medical identifiers can travel with name and date of birth. Look for claims you did not make.
• Enroll in free credit monitoring offered in the notification letter. The company is providing this service because of the breach; use it while it lasts, but do not rely on it alone.
• Treat every unexpected call, email, or letter claiming to be from a government agency or bank as suspect. With your personal details now circulating, phishing attempts tailored to you become more convincing.

This incident is now part of your permanent risk profile. The personal information listed in the June 26, 2025 filing cannot be taken back, but the steps above let you limit what criminals can do with it. The letter you did or did not receive remains the clearest signal of whether you were directly affected.