The disruption began on Sunday afternoon, leaving Albert Heijn, along with its sister brands Etos and Gall & Gall, offline. Ahold Delhaize confirmed on Monday that it had detected a security issue within its network and subsequently took precautionary measures, including temporarily shutting down affected systems. The company has not yet confirmed whether data has been compromised, nor has it provided a timeline for service restoration.
Joey Fennis, a cybersecurity expert, noted that an organization of this magnitude does not take such drastic steps without significant cause. “If malicious actors have turned the key in the front door lock, they may well have looked inside and accessed or stolen data,” Fennis stated. He compared the situation to the incident at the Dutch Public Prosecution Service (OM) last year, where a vulnerability in remote work software led to a months-long outage. Pim Takkenberg, another security specialist, emphasized that the duration of the outage is a key indicator. “An outage doesn’t usually last this long,” Takkenberg said, suggesting the shutdown is a proactive measure to prevent further damage following a confirmed breach.
While the primary assessment points to a cyberattack, expert Eward Driehuis raised an alternative possibility: that the company identified a critical vulnerability in its own systems and shut down digital operations to patch it. Regardless of the root cause, the incident highlights the profound dependence of daily life on digital infrastructure. “That becomes very tangible when you can’t do your grocery shopping,” Driehuis observed.
Operational and Supply Chain Impact
The physical supermarkets remain open, and checkout systems continue to function. However, the outage has caused significant logistical challenges. Online grocery deliveries have been suspended, and customer service and loyalty program tools are unavailable. In-store electronic price tags are displaying outdated prices from the previous week, leading to discrepancies between shelf labels and checkout totals.
Supply chain operations have been severely affected. Albert Heijn operates six distribution centers in the Netherlands. CEO Margaret Versteden-van Duijn stated on Monday that work at some of these centers had stopped completely. An email to suppliers indicated that only the Zaandam center remains operational, with suppliers instructed to deliver exclusively to that location in agreed time slots. Consequently, stores are facing empty shelves, particularly for fresh produce such as fruit and vegetables. Frozen goods and long-life products remain more widely available, but stock levels vary by location.
International Ripple Effects
The incident has extended beyond the Netherlands. In Belgium, the Delhaize supermarket chain, also owned by Ahold Delhaize, is experiencing IT difficulties. Customers in Belgium cannot place new orders for the week, and customer service is unavailable, though the website and app remain accessible. Albert Heijn stores in Belgium, which are supplied from the Tilburg distribution center in the Netherlands, may also face product shortages.
The impact has reached North America as well. On Monday, the websites for all five Ahold Delhaize supermarket chains in the US, including Stop & Shop and Food Lion, were offline. Online ordering and delivery services were suspended across these regions.
This incident occurred on the same weekend as a separate cyberattack in France, where hackers remotely forced refrigeration systems in hundreds of supermarkets to defrost, resulting in the disposal of significant amounts of fresh and frozen food. The French attack targeted equipment supplied by Danish firm Danfoss. While the timing is notable, an Ahold Delhaize spokesperson stated there is no reason to see a connection between the two incidents.
Albert Heijn remains focused on investigating the disruption and restoring services. The company has reiterated that protecting the data of customers, employees, and partners remains a top priority, though the full extent of the incident and the status of any potential data compromise remain undisclosed.
