Albert Heijn’s stores are open and its checkouts work. Its distribution centers are a different story. On Monday, CEO Margaret Versteden-van Duijn told NOS that work had stopped completely at some of them, because the company had switched its systems off as a precaution after a cybersecurity incident.
What Ahold Delhaize Has Confirmed
The disruption began on Sunday afternoon, October 11. In a statement published Monday morning, Albert Heijn said it, Etos and Gall & Gall were dealing with a cybersecurity incident and had taken immediate measures to protect their IT environment, including the temporary, precautionary shutdown of several systems. Websites, apps and customer service went offline. Logistics systems were disabled, so online grocery orders cannot be delivered until further notice. As of Monday evening, the company had not said when services would return.
Inside the stores, the picture is patchy. Checkouts and this week’s national Bonus offers work. The Mijn AH app, the personal Bonus card, Koopzegels and Air Miles do not, and electronic shelf labels may still show last week’s promotional prices, which can sit below the price at the till. Albert Heijn has asked customers who miss personal discounts to keep their receipts so it can compensate them later.
The problem reaches beyond the Netherlands. Parent company Ahold Delhaize said it is “experiencing a security issue within its network” and is taking some systems offline “to help protect them,” according to BleepingComputer. Grocery Dive reported that the websites of all five U.S. banners, including Food Lion, Hannaford and Stop & Shop, were down Monday morning. In Belgium, Delhaize customers could not place new orders for the week, VRT reported, although stores in Belgium and Luxembourg stayed open.
The Damage Sits in the Warehouse
The more consequential detail came Monday afternoon. Versteden-van Duijn told NOS that work had stopped completely in some distribution centers because “we had to switch the systems off preventively.” Albert Heijn runs six distribution centers in the Netherlands, and she would not say which ones are still working. Trade outlet Warehouse Totaal, citing RTL Z and an email sent to suppliers, reported that only the automated center in Zaandam was still running and that suppliers had been asked to deliver there within agreed time slots. Albert Heijn has not confirmed that account.
Fresh food is the most exposed. Albert Heijn expects frozen goods, bread and long-life products to stay better stocked than fruit and vegetables, and says availability will vary by store. “Of course shelves will run empty if this lasts longer,” the CEO said. One delivery driver told NOS that all drivers were thrown out of the delivery app at the same time and could not log back in.
The stoppage likely reflects a precaution rather than a confirmed hit on the warehouses. By the CEO’s account, the centers stopped because Albert Heijn turned its systems off, and the company has not said attackers reached them. It has also not explained why checkouts survived while logistics did not. One reading is that a store can keep selling what is already on its shelves, while a distribution center with its systems switched off cannot ship anything. That remains an inference, because the company has not described how its systems are connected.
No Confirmed Data Breach, and No Quick Answer
No one has said data was stolen. Albert Heijn says protecting the data of customers, employees and partners is its priority, and NOS reported that the company cannot yet say whether outsiders entered its IT systems; the CEO said the investigation is still running. Ahold Delhaize calls the event a cybersecurity incident without naming an attacker, a method or a cause, and its spokesperson did not answer whether any devices were encrypted, BleepingComputer reported. NL Times relayed RTL’s reading that the signs point to a cybercriminal attack. Neither company has confirmed that.
The group’s own history argues against expecting a fast answer on data. Ahold Delhaize disclosed a cyberattack on its U.S. banners in November 2024, which halted Hannaford’s online orders for several days. It confirmed in April 2025, about five months later, that files had been stolen, as the INC Ransom group claimed up to 6 terabytes of data from the U.S. division. Grocery Dive reports that the company later said the incident potentially exposed sensitive information of more than 2 million people.
Why the Shutdown Costs So Much
Shutting systems down early carries a clear defense. “The short-term pain of a planned shutdown is almost always preferable to an uncontrolled one,” said Muhammad Yahya Patel, a cybersecurity advisor at Huntress, in comments published by Cybernews. Marks & Spencer shows how large the bill can grow when an outage drags on. After an April ransomware attack in 2025, M&S stopped accepting online orders. In May it told investors to expect online disruption through June and into July, and it put the hit at around £300 million for 2025/26 before mitigation, BleepingComputer reported, adding that food sales also suffered from reduced availability. Albert Heijn has not said it faces ransomware, and the M&S figures are a reference point only.
Our Take: a grocer’s first-week exposure is availability. A stolen database takes months to size, as 2024 showed. A stalled distribution center shows up on shelves within days, and the products Albert Heijn flagged first, fruit and vegetables, are perishable and turn over quickly. Retail incident plans should put the restart of logistics at the center, alongside the recovery of data.
Two answers will decide how this ends: whether anyone outside the company reached its systems, and how long some of its distribution centers stay shut. If 2024 is any guide, the first will take months to settle. The second will show up in the produce aisle much sooner.
The post Albert Heijn’s Cybersecurity Incident: Checkouts Work, but Some Distribution Centers Don’t appeared first on DataFLOQ.
