Cybersecurity experts say it is very likely someone broke into Albert Heijn’s IT systems, as the outage at the Netherlands’ biggest supermarket chain leaves empty shelves in its stores.
Albert Heijn and its parent company Ahold Delhaize have kept systems switched off since Sunday afternoon and still describe the problem only as a “cybersecurity incident”. “An organisation that big doesn’t take measures like this lightly,” cybersecurity expert Joey Fennis told broadcaster NOS.
Fennis said that if attackers had got in, they may also have viewed or stolen data. Pim Takkenberg told current affairs programme Nieuwsuur it seemed “fairly clear” that someone malicious had been in the system. “An outage doesn’t usually last this long,” he said.
A third expert, Eward Driehuis, said the chain may instead have found a weakness it could not fix quickly, and shut its systems down as a precaution. Albert Heijn says its investigation is ongoing and has not said when services will be restored.
Supply chain
Albert Heijn has six distribution centres in the Netherlands. CEO Margaret Versteden-van Duijn told NOS on Monday that work at some of them had stopped completely, but she would not say which ones.
According to an email to suppliers seen by RTL Z, only the Zaandam centre is still operating, and suppliers have been asked to deliver there alone, in agreed time slots. Albert Heijn has not confirmed this.
The chain says fruit, vegetables and other fresh produce will be hardest to find, while frozen goods, bread and long-life products should remain more widely available. “Of course shelves will empty if this goes on longer,” Versteden-van Duijn told NOS. “That will vary from store to store.”
Beyond the Netherlands
Belgian supermarket chain Delhaize, also owned by Ahold Delhaize, has reported IT problems. Albert Heijn’s stores in Belgium, which are supplied from the Tilburg distribution centre, may run short of some products, broadcaster VRT reported, although the chain says the impact there is limited so far.
In the US, the websites of all five Ahold Delhaize supermarket chains, including Stop & Shop and Food Lion, were offline on Monday, according to trade publication Grocery Dive. Online ordering and deliveries were also suspended, Supermarket News reported.
The incident came on the same weekend as a separate cyberattack on hundreds of supermarkets in France. There, hackers remotely forced refrigeration systems to defrost, and chains including Intermarché and Coopérative U had to throw away fresh and frozen food. The Paris prosecutor’s office has opened an investigation.
The French attack targeted refrigeration equipment supplied by Danish firm Danfoss. Albert Heijn’s CEO told NOS she could not say whether the two incidents were linked, but an Ahold Delhaize spokesperson later told the news agency Reuters there was no reason to see a connection.
