Ahold Delhaize IT Outage Hits Albert Heijn, Delhaize

A cybersecurity incident at retail group Ahold Delhaize has left supermarket chains Albert Heijn and Delhaize dealing with disrupted supply and offline digital services in Belgium, with the group warning that some products could be temporarily unavailable. The outage, which began on Sunday afternoon, 11 October, remains unresolved as of Tuesday, and the company has given no timeline for restoring its systems.

According to VRT NWS, Albert Heijn has been contending with a “cybersecurity incident” since Sunday and shut down a number of systems as a precaution. “We took immediate measures to protect our IT environment,” the chain said, a message that was still visible on its website on Tuesday, indicating the problem has not yet been solved.

An incident spanning two continents

Ahold Delhaize, headquartered in Zaandam in the Netherlands, took systems offline preventively to protect its IT environment. Because the group’s brands share a common IT backbone, the incident simultaneously affects eight banners across Europe and the United States — including Albert Heijn, Etos and Gall & Gall in the Netherlands, Delhaize in Belgium and Luxembourg, and US chains such as Stop & Shop and Food Lion.

In Belgium, the impact has so far been more contained than in the Netherlands. Albert Heijn, which operates 88 stores in the country, is normally supplied from a distribution centre in Tilburg. With that centre hampered, Belgian stores are now being supplied from other distribution centres, though less abundantly than usual. The chain has not ruled out that certain products may be temporarily unavailable.

Albert Heijn spokesperson Ann Maes sought to reassure customers, telling the Belgian news agency Belga that “the deliveries to the stores are continuing” and that “empty shelves, there are none” — while acknowledging the picture could differ from place to place. Online grocery ordering remains unavailable at Albert Heijn in Belgium.

Delhaize switches to manual ordering

At Delhaize, IT systems remain offline. Spokesperson Roel Dekelver said the situation was “still unchanged,” with systems having been taken offline by the Ahold Delhaize group the previous day. Normally, individual stores place their own product orders, but with that system down, Delhaize has centralised the process, making estimates based on historical orders.

“We continue to supply the stores, despite the difficult circumstances,” Dekelver said. “We do it in an alternative way.” He added that the online ordering system had come back online since Monday evening via an alternative system with limited capacity, and that customer service had also partially restarted. All Delhaize stores in Belgium and Luxembourg remain open for in-store shopping.

In the Netherlands, where the impact is more severe, the situation is starkly different. Several of Albert Heijn’s distribution centres have been shut down, with some fully halted. CEO Margaret Versteden-van Duijn confirmed that work at some centres was “completely at a standstill.” According to NOS, fresh produce such as vegetables, fruit and dairy is hardest hit, and one reporter saw only three of an expected 20 daily pallets arrive at a store in Lelystad.

Cause still unconfirmed

Ahold Delhaize has not confirmed whether the incident was a hack, has not named any attacker, and has not said whether customer data was accessed. The company said only that protecting the data of customers, staff and partners is a priority.

Cybersecurity experts told NOS that a malicious intrusion is highly likely, given the scale of the response. “An organisation that big doesn’t just take measures like this,” said expert Joey Fennis, who noted that such a decision typically requires board-level approval and that attackers may have viewed or stolen data if they gained entry.

Fellow expert Pim Takkenberg said: “It seems fairly clear to me that a malicious actor has been in the system. An outage doesn’t usually last this long.” He said a criminal group seeking money was most likely, and considered a Russian state actor improbable. A third expert, Eward Driehuis, suggested the chain may instead have found a vulnerability it could not fix quickly and shut systems down as a precaution.

The DutchNews.nl outlet reported that tills are still working, but electronic shelf labels may show last week’s promotional prices, and personal or app-linked discounts cannot currently be redeemed. Customers have been asked to keep receipts so they can be compensated once systems are restored.

Broader concerns

The incident coincides with a separate cyberattack on French supermarkets the same weekend, in which hackers remotely raised refrigeration temperatures, forcing chains to discard fresh and frozen food. Ahold Delhaize told Reuters there was no reason to connect the two events.

The disruption has also drawn official attention. The Dutch Ministry of Agriculture, Fisheries, Food Security and Nature called the outage “concerning,” and the Dutch food retail association said it was considering contingencies should supply problems persist.

What to watch

With no restoration timeline from Ahold Delhaize, the coming days will determine how long Belgian supply chains can hold out and whether the group confirms a data breach — a question that carries legal weight under EU rules such as GDPR and NIS2. For now, Belgian stores remain open and stocked, but the group’s silence on the cause has left customers and experts alike watching for clarity on how far the damage reaches.