contact@trustinfinitech.com (573) 234-6540

Who Pulls the Plug? Deciding to Take Systems Offline Before an Attacker Decides for You

Home/News/Who Pulls the Plug? Deciding to Take Systems Offline Before an Attacker Decides for You

October 19, 2026  ·  Austin Hindery  ·  Latest News Managed Services Security Newsletter

A monumental corridor where heavy steel doors slide closed to hold back cold blue streams of light, while a warm amber stream keeps flowing on the near side, representing a deliberate shutdown that protects essential operations.

On Monday, October 12, 2026, Ahold Delhaize, the parent company of Food Lion, Hannaford, Stop & Shop and the two Giant grocery chains, said it was dealing with a security issue on its network and had taken some systems offline to help protect them. Websites for its U.S. banners went down and online ordering was suspended. Two days later, the U.S. sites and apps were still offline, while stores, pharmacies and fuel stations kept serving customers.

That choice, deliberately disconnecting your own systems before you fully understand what is happening, is what we mean by “pulling the plug.” It is one of the most expensive calls a leadership team can make during an incident. Most organizations have never decided in advance who gets to make it, what should trigger it, or how the business keeps running afterward.

Key takeaways

  • A precautionary shutdown is a business decision with technical inputs. Federal guidance treats it as a leadership call that should be assigned before an incident.
  • The cost of disconnecting shows up immediately, while the cost of waiting stays hidden until it is too late to avoid. Set your triggers while you can still think clearly.
  • Containment works best when the business has already practiced operating without the systems it is about to switch off.

What happened at Ahold Delhaize

Here is what the company and reporters had confirmed as of October 19, 2026:

  • Disclosure: Ahold Delhaize first disclosed the issue on October 12 and said it was working with internal teams, external cybersecurity experts and “the appropriate authorities,” according to its company statement.
  • What went offline: In the U.S., banner websites were taken down and online grocery ordering and deliveries were suspended, Supermarket News reported. In Europe, local media reported disrupted deliveries and online orders at Albert Heijn and Delhaize, according to SecurityWeek.
  • What kept working: Stores stayed open. GIANT customers could still order delivery through Instacart, DoorDash and Uber Eats, and unfulfilled online orders were being refunded, NBC10 Philadelphia reported.
  • Recovery: In its October 13 update, the company said it had begun “a controlled re-launch of certain systems.” It has not announced a full restoration date.

Several questions remain open. As of mid-October, the company had not said how the intrusion began or whether any group had claimed responsibility. It says it has “no evidence at this moment” that customer, associate or partner data was taken, and the investigation is ongoing. This is also not the company’s first incident: SecurityWeek notes that a November 2024 attack, later claimed by the INC ransomware group, compromised personal information belonging to about 2.2 million people.

Why disconnecting is a leadership decision

Federal guidance is direct about who owns this call. NIST’s incident response guide, SP 800-61 Revision 3, published in April 2025, says leadership “may have decision-making authority on high-impact response actions, such as shutting down or rebuilding critical services.” It also says incident response policies should define “which roles have the authority to confiscate, disconnect, or shut down technology assets.”

The technical advice points the same way. The #StopRansomware Guide from CISA and its federal partners tells responders to determine which systems were impacted “and immediately isolate them,” and to take the network offline at the switch level if several systems or subnets appear affected. “Immediately” leaves no room for a two-hour search for someone with authority to approve it.

The cost of disconnecting is easy to see

After a cyberattack at the end of August 2025, Jaguar Land Rover said it “took immediate action to mitigate its impact by proactively shutting down our systems,” Security Affairs reported. Manufacturing stayed paused for more than a month, with a phased restart beginning October 6, 2025, according to PA Media and dpa reporting carried by Malay Mail. The UK government later backed a loan guarantee expected to unlock up to £1.5 billion to strengthen JLR’s cash reserves and give its supply chain certainty, according to a GOV.UK announcement.

The cost of waiting is harder to see

The following is our analysis. Public reporting rarely shows what a shutdown prevented, so no outsider can say how much worse either incident would have been if systems had stayed up. That imbalance is the core problem. In the moment, the visible cost of downtime pulls leaders toward waiting, while the cost of an attacker reaching backups, finance systems or every server in the building stays hypothetical until it arrives. Deciding thresholds ahead of time is the most reliable way to keep that pressure from making the decision for you.

Three questions to answer before an incident

These questions follow from the NIST guidance above, applied to a typical organization of 50 to 500 employees.

  1. Who can authorize it at 2 a.m. on a Saturday? Name a primary decision maker and a backup, and write down what each may approve without a meeting. Isolating one laptop should never need an executive. Taking the whole network offline probably should, but only if that executive can be reached within minutes.
  2. What triggers it? Agree on conditions that justify isolation before anyone has to argue about them. Examples include signs of encryption on more than one server, an administrator account signing in from an unfamiliar location, or your security provider reporting attacker activity inside your environment.
  3. What keeps running? Ahold Delhaize kept its stores open while its digital channels were down, and steered delivery customers to third-party apps. Know which of your processes can run on paper, by phone or through a partner for a week, and which ones stop entirely.

What to do next

This month

  • Write a one-page containment authority. List who can isolate a device, a site, a cloud account or the whole network, with after-hours phone numbers for each person and their backup.
  • Print it. The #StopRansomware Guide says to keep “a hard copy of the plan and an offline version,” and to use out-of-band methods such as phone calls during an incident. If email and Teams are what you just disconnected, your contact list cannot live only there.
  • Read your provider contracts. NIST notes that contracts with third parties should spell out operational decisions they may make, such as “immediately deactivating certain services to contain an incident.” Ask your MSP or security provider three questions: What can you isolate without calling us? How quickly? Whom do you call first?

This quarter

  • Rank your critical systems. CISA advises restoring “based on a predefined critical asset list.” Rank systems by revenue, safety and customer impact, then confirm the order with department heads.
  • Build a degraded-mode plan for your top three processes. As an illustration, a hypothetical 150-person distributor whose order system has been isolated might take orders by phone on printed forms, quote from a printed price list, and batch-enter everything once systems are cleared. Check that staff know where those forms are.
  • Check your cyber insurance policy. Find out whether it requires you to notify the insurer, or to use its approved responders, before you engage outside help. Add that call to your one-page sheet.
  • Run a 60-minute tabletop exercise with a clock running. Start with a scenario in which two file servers show signs of encryption at 6:40 a.m. Time how long it takes to reach the decision maker and agree to disconnect.

Where InfiniTech fits

The value of a containment decision depends on how fast someone spots the problem and how clearly they are authorized to act. The InfiniCare Advanced Security Bundle includes managed detection and response, with a security analyst team monitoring, investigating and responding around the clock across endpoints, servers, Microsoft 365 and firewalls. Any MDR arrangement, ours included, should state in writing which containment steps analysts may take on their own and when they must call you first.

Conclusion

Ahold Delhaize’s websites went dark while its stores stayed open. Whatever the investigation finds, that outcome depended on choices made long before October 12 about what could keep running without which systems. The right time to decide who pulls the plug, and what the business does next, is an ordinary afternoon with no incident underway. If your leadership team cannot name that person today, start there.

Sources

← Back to News