Albert Heijn and Delhaize hit by cyber incidents, apps and online orders down
Albert Heijn's app, website and loyalty savings stopped working on 12 October, and online orders cannot be delivered. Its sister brand Delhaize in Belgium reported an IT incident the same day, while stores in both countries remain open.
What customers face at Albert Heijn
On Monday, 12 October, the Albert Heijn app and website were down after the company reported a 'cybersecurity incident', and online orders could not be delivered. Savings systems linked to the app, including the redemption of koopzegels (loyalty vouchers) and the personal bonus card, did not work. Cash registers and national bonus offers still functioned, and customers could pay by card, but personal discounts could not be applied. Store staff advised shoppers to keep their receipts so that missed discounts could be claimed later. Shelf labels still showed the promotional prices from the previous week, so some shoppers saw a lower price on the shelf than at the till. In the Middelburg branch, the screens displayed a 'No Internet' error, and customer service could not be reached.
Ahold Delhaize's response
Albert Heijn said on the morning of 12 October that it was investigating the incident and working to restore its services, and that protecting the data of customers, employees and partners came first. The company also offered an apology for the situation.
We would like to offer our sincere apologies for this situation.
The parent company, Ahold Delhaize, said on an information page that it was taking 'measures' to protect its IT environment, including switching off several systems, but a spokesperson did not confirm a cyberattack. According to NRC, Albert Heijn had partly disconnected its IT systems for security reasons since the evening of 11 October. NOS reported that managers of Limburg branches were informed late on the afternoon of 11 October and assume a hack, although they cannot comment officially. Managers of all branches held a videocall on 12 October, and NOS put the number of Albert Heijn branches in the Netherlands at more than 1,200.
- Limburg Albert Heijn managers are informed of the incident and assume a hack, according to NOS
- Albert Heijn partly disconnects its IT systems for security reasons, and problems begin, according to NRC
- Cyberattack switches off refrigeration at 150 to 200 Supermarché and Coopérative U stores in France, according to Le Monde
- Albert Heijn confirms a cybersecurity incident, its app and website are down, and it apologises to customers
Delhaize and smaller brands
Delhaize, which operates in Belgium and Luxembourg, reported an IT incident on 12 October and said it had acted immediately, switching some systems off as a precaution. Its stores in both countries stayed open, its distribution centre kept working, and online orders were still being delivered that day, according to De Morgen. Delhaize said it could not yet say when all its systems would be available again, and its customer service was unreachable.
Protecting the data of our customers, our employees and our partners is our absolute priority.
Etos and Gall & Gall, which fall under the same group, are also affected. A Gall & Gall employee in Maastricht said only email was not working and that prices were calculated correctly. Picnic saw more orders for Tuesday, 13 October, scaled up its delivery capacity and expects several thousand extra orders if the trend continues. Jumbo also reported more online orders but shared no figures.
A cyberattack in France
Le Monde reported that 150 to 200 stores of the supermarket chains Supermarché and Coopérative U were hit by a cyberattack on their refrigeration equipment on the night of 11 October. The cooling was switched off remotely, so frozen products and fresh meals thawed and had to be thrown away. Dominique Schelcher, the top executive of Coopérative U, called the attack unacceptable in a post on X. BFM-TV reported that the chain E.Leclerc may also have been affected, but the chain has not confirmed this. The articles do not say whether the French attack is linked to the incidents in the Netherlands and Belgium.
Customer concerns and open questions
Customers reacted differently. One feared for personal data and expected a flood of calls from unknown numbers, as after the hack of De Bijenkorf, while another said that without a computer there was little to lose. Els Breugelmans told De Morgen that such incidents are unusual in Belgium, although they have occurred at Walmart and Target in the past. She said retailers hold e-mail, contact and possibly payment details when customers pay through the app, and that the financial impact depends mainly on how quickly the IT services can restore the systems. The cause of the incident is still unclear, and neither Albert Heijn nor Ahold Delhaize has given a date for when services will be restored.
