A week after Ahold Delhaize took systems offline to contain a cyber incident, its Dutch supermarket chain Albert Heijn still cannot take a single online order. In its latest update on 16 October, the chain said it had cancelled all online grocery orders until at least Tuesday 20 October, that new orders still cannot be placed, and that it hopes to restart home deliveries later in the coming week. When IntelFusions checked on Sunday morning, ah.nl, its Belgian twin ah.be and the site of sister drugstore chain Etos were still serving outage pages.
The trouble began on the afternoon of Sunday 11 October. The next day the Zaandam-based group disclosed "a security issue within its network" in a statement flagged as inside information under the Market Abuse Regulation, the EU's label for price-sensitive news. Its follow-up says it is working with external cybersecurity experts and the authorities, has begun a controlled relaunch of some systems, and has no evidence at this moment that customer, associate or partner data was taken. Its stores in Europe and the United States stayed open, the group says, but the impact "differs per brand".
The tills kept ringing as the web shop went dark
Albert Heijn, which its parent says runs 1,288 stores in the Netherlands and Belgium, keeps a running media statement showing what a precautionary shutdown looks like from the shop floor. By Monday morning, the websites, apps, customer service and logistics systems of Albert Heijn, Etos and the liquor chain Gall & Gall were switched off. Electronic shelf labels were stuck on the previous week's promotional prices, and loyalty schemes from Koopzegels savings stamps to Air Miles stopped working. The checkouts kept working throughout.
Recovery has come in layers. Shelf prices were showing correctly again on 13 October, the distribution centres were back up by the evening of 14 October, and normal deliveries of fresh and long-life products had resumed nationwide by 15 October. That evening the chain said its shelves were full again. Online ordering, customer service and personal discounts are still unavailable.
Belgium's Delhaize is already back online
Delhaize, the group's chain in Belgium and Luxembourg, reports an "IT incident" that started on the same Sunday. Its status page, last updated on 16 October, says its Delivery and Collect services are running again, though digital e-Deals coupons are unavailable and order emails and texts may still be disrupted. It is in contact with the competent authorities and has no indication that customer or employee data was involved.
No sign of a link to France's fridge attacks
The incident began a day before CERT-FR warned, on 12 October, of numerous compromises of remote controllers for refrigeration systems, attacks the agency said on 16 October are probably still under way. On 13 October the Dutch National Cyber Security Centre said several cyber incidents were playing out in Europe's food sector, but that it currently sees no reason to assume they are connected. Ahold Delhaize has not said what caused its incident, and no extortion group had claimed it on the leak sites we track as of Sunday.
The NCSC also used that note to remind companies that the Cyberbeveiligingswet, the Dutch law that puts the EU's NIS2 directive into effect, has applied since 15 August. It covers about 8,000 organisations in 18 critical sectors, which must report significant incidents to their sector's CSIRT and regulator.
Keep your receipts and ignore refund messages
Albert Heijn says prepaid online orders will be refunded once its systems work again, and that it is working out how to compensate lost personal discounts. It asks shoppers to keep receipts so missed Koopzegels can be bought later. The chain also warns that criminals exploit incidents like this by posing as company staff. Treat any unexpected call, text or email offering a refund or compensation as suspect. Bonus card holders got an email on 15 October, so treat any claimed follow-up with particular care.
A supermarket can keep selling bread with its website dark, as Albert Heijn has shown this week. What takes longer to rebuild is everything digital stacked on top of the till, and a week in, that work is still not finished.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.