Cyberattack halts Albert Heijn’s deliveries and restocking
On 12 October Ahold Delhaize reported a cyber incident. Its Dutch chains Albert Heijn, Etos and Gall & Gall switched systems off as a precaution, and deliveries and restocking ground to a halt.
What happened
Albert Heijn, the largest supermarket chain in the Netherlands, and its sister chains Etos and Gall & Gall switched off a large part of their systems as a precaution. That took down the websites and home delivery, and the restocking of the shops too.
The incident began on the afternoon of Sunday 11 October at the parent company, Ahold Delhaize. By Monday the websites, apps and customer service were down, online orders went undelivered and the electronic shelf labels still showed the previous week’s offers. Personal discounts and loyalty stamps stopped working too. Several of Albert Heijn’s six Dutch distribution centres came to a complete stop, said Margaret Versteden-van Duijn, chief executive of Ahold Delhaize Europe. According to Daan Heijnk, editor-in-chief of the trade magazine Distrifood, shops were then restocked at random: one shop had nothing but bananas, another only red peppers.
Delhaize in Belgium reported problems too, and in the United States the websites and apps of Food Lion, Stop & Shop and Hannaford, among others, went offline. Sources told the Dutch broadcaster NOS that Albert Heijn had seen suspicious traffic routed through servers in the US, Poland, Moldova and Turkey, possibly including servers of Ahold’s own American arm. This has not been officially confirmed. On Tuesday Ahold Delhaize began a controlled restart of its systems, and by Wednesday Albert Heijn expected all its distribution centres to be running again.
On 19 October Ahold Delhaize confirmed that malicious actors were behind the suspicious activity. It had reported the incident to the Dutch National Cyber Security Centre (NCSC) within 24 hours and now also filed a police report. Ahold says it has so far found no evidence that sensitive data of customers, staff or partners was taken; Versteden-van Duijn had earlier denied rumours of a ransom demand. The websites of Albert Heijn, Etos and Gall & Gall are back, and Albert Heijn’s home deliveries are due to restart from Friday 23 October.
Taking systems offline as a precaution was, according to the investigation so far, the right decision.
Ahold Delhaize CEO Frans Muller on 19 October 2026, in short
The background
Why an outage hits the shelves straight away
Albert Heijn supplies its shops from six distribution centres in the Netherlands. The shops keep little stock and are supplied soon after they order. When the systems go down, the stock is still in the distribution centre, but it can no longer be sent to the right shops. Heijnk calls that the downside of a model that is very efficient as long as everything works.
Albert Heijn’s Belgian shops are normally supplied from Tilburg. When that centre stopped, other Dutch centres stepped in, and according to a spokesperson customers in Belgium barely noticed.
Supermarkets are a target more often
In April 2021 ransomware took down the haulier Bakker Logistiek. For days it could deliver less, and the cheese shelves at Albert Heijn ran empty. In November 2024 Ahold Delhaize was hit in the US; the criminal group INC Ransom claimed the attack, and according to a filing with US regulators the data of more than 2.2 million people was stolen.
That same weekend, attackers in France turned up the cooling over the internet in more than 500 supermarkets, to as much as 50°C. Danfoss, which made the systems, blames outdated equipment. The NCSC saw no reason to suspect a link with Ahold.
What the Dutch Cybersecurity Act asks
Since 15 August the Netherlands has had its Cybersecurity Act, the Dutch version of the EU’s NIS2 directive. According to NOS it covers some 8,000 organisations, from hospitals and water companies to banks and the food sector, supermarkets included. In 2021 the food sector could not yet turn to the NCSC for help after a hack; now these companies have to register with it.
After a serious incident comes an early warning within 24 hours, a notification within 72 hours and a final report within a month. For supermarkets the supervisor is the Netherlands Food and Consumer Product Safety Authority. It checks whether a company had taken appropriate measures and had a plan ready for a successful attack, and it can impose fines. Board members have to approve the measures themselves and know enough about them.
Our analysis
Run everything centrally, and everything stops centrally
What stands out is what has not happened so far: as far as is known, no sensitive data was taken, and rumours of a ransom were denied. NOS sources say the quick shutdown kept the attackers out of the deeper systems, so the empty shelves were mostly the result of the company’s own emergency stop. That was probably the right call, but it shows how costly that call becomes when restocking, deliveries, shelf labels and loyalty schemes all hang on the same systems, in several countries at once.
What the coverage misses: an emergency stop is only a good plan if you know what still works afterwards. In Belgium, switching to other distribution centres made a big difference. You don’t come up with routes like that in the middle of an incident. The French fridge attack is often mentioned in the same breath, but it is a different story: outdated equipment left openly connected to the internet.
Our expectation: because of the Cybersecurity Act we will hear about incidents like this more often and earlier, at a stage when little is certain yet. Joke Bodewits of the law firm Hogan Lovells Cadwalader pointed out to NOS that first assessments are often wrong. Suppliers to such organisations will get more questions about how fast they report incidents and what they do when an integration drops out.
What stands out
- The trail may lead through America According to NOS sources, the suspicious traffic may also have run through servers of Ahold’s own American arm. Ahold has not confirmed this.
- The empty shelves came from the emergency stop Switching off kept the attackers out of the deeper systems, NOS sources say. The standstill was the price of that precaution.
- Even the shelf labels depended on it Shelf labels showed last week’s offers, and customers were asked to keep their receipts for missed discounts and stamps.
- The report came before the findings Ahold reported the incident to the NCSC within 24 hours, but only confirmed a week later that malicious actors were behind it.
What it means for you
If your business runs on systems that are linked together, one incident can stop far more than you expect.
- Know which links are critical At Albert Heijn, deliveries, restocking and customer service all fell away at once. List the integrations and devices that would stop your work if they failed.
- Decide what carries on without them Albert Heijn’s stores stayed open. Agree in advance what can keep going without a system, who makes that call and how you start up again.
- Suppliers get questions too Organisations covered by the Dutch Cybersecurity Act must map the risks their suppliers bring, and may set requirements for them. Expect questions about how your systems are secured and what happens if they fail.
Where we come in · Development
We help you work out which integrations matter
We build integrations between ERP, CRM, accounts and webshop, and custom software that is easy to hand over. We’re happy to look with you at which links are critical for you, and what should happen if one of them fails.
Do you know which integration would stop your work if it failed?
Tell us which of your systems are linked together. We’ll think it through with you and always reply within one working day.
