Supermarket Cyber Incident Leaves Online Shoppers Facing at Least 11 Days Without Deliveries

Online shoppers at Albert Heijn, the Netherlands' largest supermarket chain, face at least 11 days without home grocery deliveries after a cybersecurity incident forced its parent company, Dutch-Belgian retailer Ahold Delhaize, to take systems offline.

Ahold Delhaize expects deliveries to resume gradually from Friday, 23 October, after the disruption began on 11 October. The incident affected online services across several European and US supermarket brands, although recovery has progressed at different speeds. The company has reported no evidence that sensitive customer, employee or partner data was taken.

Deliveries Expected From 23 October

Albert Heijn's website and mobile app returned on 18 October, allowing customers to access most of their account information and some restored features. Online grocery ordering remained unavailable, however, and orders were cancelled through Thursday, 22 October. The supermarket plans to restart home deliveries gradually the following day rather than restore the service in a single step.

Customer service was also affected. Albert Heijn's customer service was still being brought back online and was not yet available on 19 October, according to ESM Magazine. The disruption left customers with fewer ways to resolve order problems while online shopping remained suspended. Albert Heijn has also warned customers to watch out for possible phishing attempts.

Customers whose orders were cancelled will receive compensation within a few days and those who paid in advance will receive automatic refunds. Albert Heijn is also arranging compensation for missed personal discounts, Air Miles points and koopzegels, the Dutch savings stamps. Most adjustments are to be made automatically, without customers having to submit individual claims.

Albert Heijn has advised customers to keep their receipts, as they may be able to buy missed loyalty stamps in store.

Estimated Cost Runs Into Millions

Industry experts estimate the incident has cost Albert Heijn at least €10 million (about £8.7 million), according to NL Times, citing the Dutch news agency ANP. The figure does not include the cost of bringing in IT specialists.

Cor Molenaar, emeritus professor of e-marketing at Erasmus University Rotterdam, put the damage at around €10 million (about £8.7 million) in the NL Times report, published on 14 October. 'But those losses could increase exponentially the longer it takes,' he said.

US and Belgian Services Follow Different Timelines

The incident also affected Ahold Delhaize's US supermarket chains, including Stop & Shop, Giant Food, Hannaford and Food Lion. Their websites remained offline on 19 October, when the group expected e-commerce services at its US businesses to return in the coming days. It did not give a single confirmed restart date for all four chains.

In Belgium, supermarket chain Delhaize had restored its online services by 19 October. The group also reported that the websites of Etos, a health and beauty retailer, and Gall & Gall, a drinks retailer, were available again. Recovery varied by brand, even within the same corporate group. Physical supermarkets remained open throughout the incident, while some digital services and distribution operations were disrupted.

Company Files Police Report in the Netherlands

Ahold Delhaize disclosed the incident on 12 October, a day after detecting suspicious activity in its IT infrastructure. It took some systems offline as a precaution while cybersecurity specialists investigated. In its update on 19 October, the company confirmed that the activity resulted from malicious actions by others. It did not identify those responsible or disclose technical details about the incident.

On 19 October, Ahold Delhaize filed a police report in the Netherlands and confirmed that it had notified the Dutch National Cyber Security Centre (NCSC), the country's national cybersecurity authority, within 24 hours of discovering the malicious activity. The company said it was cooperating with law enforcement and other relevant authorities. The investigation remained ongoing.

Distribution Centres Resume Operations

The disruption also affected the movement of goods to stores. Albert Heijn temporarily lost the use of distribution systems, contributing to shortages, particularly among fresh products. By 15 October, its distribution centres were operating again and regular deliveries of fresh and shelf-stable goods had resumed nationwide. Product availability could still vary between stores as supplies recovered, although restocking had returned to its regular schedule.

The incident coincided with cyberattacks on refrigeration systems at hundreds of French supermarkets, where some stores reported spoiled food and other damage. The Dutch NCSC said it saw 'no reason at this time to believe' the incidents were linked. Ahold Delhaize has said its investigation is ongoing and has not disclosed technical details about the incident.