What the company reported

Ahold Delhaize, the parent company of Albert Heijn, Etos, Gall & Gall and the online retailer Bol, filed a report with Dutch police on Monday, 19 October. The company now describes the disruption as a cyberattack, saying its internal investigation found that the suspicious activity came from malicious actions by third parties. The attackers have not been identified. Ahold Delhaize says it detected the activity itself, brought in external cybersecurity experts and informed the National Cyber Security Centrum (NCSC) within 24 hours. Companies that face a significant incident are legally required to report it to the NCSC. The filing follows an appeal by the police and the Openbaar Ministerie (public prosecution service) issued on Wednesday, 14 October, asking victims to report as quickly as possible, and earlier contact between Ahold and the authorities had not led to a report at that point.

Systems taken offline

To limit the damage, the company took several websites and apps offline as a precaution in Europe and the United States. French-language outlet RTBF dates the incident to Sunday, 11 October, and says it disrupted Delhaize and Albert Heijn. The company says it has no indication so far that sensitive customer, employee or partner data was stolen, but the investigation is still ongoing. Ahold Delhaize is giving no further details on the security measures it took, citing security reasons. Several US sites, including Food Lion, Stop & Shop and The Giant Company, were still offline on Monday morning.

Shelves, orders and deliveries

Albert Heijn stores stayed open during the IT disruption, but shelves were empty for several days in various locations. The websites of Albert Heijn, Etos and Gall & Gall have been back online since Sunday, 18 October, and stores are being restocked several times a day on the regular schedule. At Delhaize in Belgium, store orders became possible again on Friday, 16 October, through an older system, and online orders resumed on Saturday, 17 October, according to RTBF. Albert Heijn plans to restart home deliveries gradually from Friday, 23 October. Orders scheduled through Thursday were cancelled, and new online orders remained temporarily impossible at the time of reporting.

Muller's response

Ahold Delhaize chief executive Frans Muller wrote in the company statement that taking systems offline was a precautionary measure that reached most of the group's brands. He called it a precaution that affected most of the group's brands in Europe and the United States.

“Taking systems offline was a precautionary measure that affected most of our brands in Europe and the United States.”

Muller said he was pleased with that choice despite the inconvenience, and that the investigation so far shows it was the right decision. In the same statement he apologised for the inconvenience caused.

“Although this incident was caused by malicious actions by others, we apologise for the inconvenience it has caused, particularly to our customers.”

The company also thanked staff across the organisation for their tireless efforts to restore operations and serve customers in its stores.

What remains open

The investigation is still running, and the attackers have not been identified. Police and the Openbaar Ministerie now have the company's report, and none of the sources mention arrests or suspects. Ahold Delhaize has said it will not share further details on its security measures. Its statement also gave no timing for when the US sites that were still offline on Monday morning would be restored.