Grocery deliveries resumed and online ordering reopened to all customers on October 23 following the Albert Heijn cybersecurity incident, which prompted precautionary shutdowns of digital and logistics systems. The restart marks a recovery milestone after disruption that began on October 11 and affected Albert Heijn, Etos and Gall & Gall, all part of Ahold Delhaize.
In its October 23 recovery update, Albert Heijn confirmed that the first customers had received their groceries that morning. Initial deliveries went to business customers and customers with a delivery subscription, before online ordering became available to everyone.
Store replenishment had already fully resumed, with fresh and shelf-stable goods delivered at their normal frequency across all product groups. This included distribution to stores, while electronic shelf labels were again displaying correct prices, including current promotional prices.
Albert Heijn’s website and Mijn AH app - the ‘My AH’ portal - were also back online, giving customers access to personal accounts and many loyalty functions. Customer service had reopened through chat, while telephone support was restarting gradually on October 23. The company warned that waiting times could be longer following the interruption.
Customers whose online orders were cancelled receive €10 in shopping credit. Albert Heijn said prepaid cancelled orders had been refunded. Delivery-subscription customers also receive €10 in credit for the period when they could not use their subscription, and the retailer reported that missed Air Miles had been credited back.
Ahold Delhaize, the chains’ parent company, said in its October 19 investigation update that cybersecurity experts had confirmed suspicious activity resulted from the malicious actions of others. It filed a formal report with Dutch police that day.
The group said it notified the Dutch National Cyber Security Centre (NCSC) within 24 hours of discovering the malicious activity and continued providing information to law enforcement and relevant regulatory authorities.
Ahold Delhaize took systems offline itself as a protective measure. The shutdowns affected most of its brands across Europe and the United States, although the impact varied. Physical stores remained open throughout. The statements reviewed do not identify an attack method or those responsible, and do not confirm a ransomware attack, phishing, a third-party API breach, an Active Directory compromise or stolen MSP credentials. They also do not disclose indicators of compromise.
As of its October 19 statement, Ahold Delhaize said it had no evidence suggesting sensitive customer, employee or partner data had been taken. Albert Heijn’s October 23 update continued to describe an investigation into the incident’s nature and circumstances.
The earlier statement does not constitute a final finding ruling out data theft or confirming that customer data was compromised or personal data stolen. Any assessment of GDPR personal-data breach notification obligations depends on the facts established about a personal-data breach; the reported NCSC notification is not itself evidence that those obligations were triggered.
The incident affected logistics, pricing displays and loyalty services as well as online orders, interrupting online grocery ordering and distribution operations. Its operational impact connects the recovery to broader cybersecurity governance, supply-chain risk management and continuity requirements in Food Retail.
For organizations within the scope of NIS2 risk-management requirements, the EU directive includes business continuity, backup management, disaster recovery and supply-chain security measures. The incident alone does not establish the retailer’s regulatory obligations under NIS2 or the Dutch Cybersecurity Act.
The confirmed delivery restart does not establish that every service has returned to normal. Further official statements would clarify full delivery-capacity restoration, remaining service restrictions and the investigation’s findings.