Customers of Albert Heijn, the largest supermarket chain in the Netherlands, can now access the company's website and app, but they still cannot place grocery orders online. Parent company Ahold Delhaize expects the gradual resumption of deliveries starting Friday (23), after a cybersecurity incident that disrupted digital services in several countries.
On Monday (19), the company confirmed that the suspicious activity detected in its IT infrastructure was caused by malicious actions by third parties. The group also filed a formal report with the Dutch police, one week after publicly disclosing the incident on October 12.
The company had proactively disabled some of its systems, including brand websites and apps in Europe and the United States. Physical stores remained open, although some operations faced supply difficulties.
Frans Muller, president and CEO of Ahold Delhaize, said that taking the systems offline was a preventive measure that affected most of the group's brands on both continents. According to the executive, the results of the investigation so far confirm that the decision was appropriate.
Websites restored, but deliveries still disrupted
Albert Heijn's recovery shows the difference between restoring a digital platform and recovering its capacity to sell and deliver products.
The website and app were back up on October 18, again allowing access to personal accounts, loyalty programs, discounts and product information. However, new grocery orders remained unavailable in the October 19 update.
The chain confirmed the cancellation of all deliveries scheduled through Thursday (22). Customers who had already paid for canceled orders should receive automatic refunds in the following days.
Stocking at physical stores, on the other hand, had already returned to its regular pace, including fresh and non-perishable products. This means that the logistical recovery of physical stores moved ahead before the resumption of home deliveries.
The disruption carries significant commercial weight: online sales account for approximately 10% of Albert Heijn's sales, according to Reuters.
In other markets, the recovery is at different stages. In Belgium, e-commerce services had already been fully restored on October 19. In Central Europe and Southeastern Europe, most websites and apps were available again.
In the United States, brands such as Stop & Shop, Giant Food, Hannaford and Food Lion were still facing digital disruptions. Ahold Delhaize said it expected to restore e-commerce services in the following days, without setting a specific date.
The company also disclosed that it had notified the National Cyber Security Center of the Netherlands (NCSC) within 24 hours of detecting the malicious activity.
The investigation remains ongoing. As of October 19, Ahold Delhaize said it had found no evidence that sensitive data had been extracted from customers, employees or partners. The company did not publicly identify those responsible for the attack, nor did it disclose technical details about the method used.
