Albert Heijn down four days: the supplier's view (11/10/2026)
Four working days with no systems at a major retailer. Seen from the supplier's side, that is not news: it is a week of revenue moved. The dated sequence, the three mechanisms that cost real money, and the list to clear before next Friday.
The short version
On Sunday 11 October 2026, early in the afternoon, Ahold Delhaize preventively took part of its systems offline after a cybersecurity incident. Websites, apps, customer service and the logistics systems of Albert Heijn, Etos and Gall & Gall stopped, and Delhaize switched to backup arrangements[2][4]. Distribution centres only restarted on Wednesday 14 October, and regular deliveries of ambient and fresh products were only restored on the morning of Thursday 15 October[2]. On Tuesday 13 October the Dutch NCSC reported several incidents in the European food sector, while stating it currently had no reason to believe they were connected[1].
If you run an SME, the lesson is not that you should protect yourself better. It is this: one of your largest accounts can be unreachable for four working days, and your cash position will feel it before your IT does. This article is about the supply chain cyber incident that hits someone else's servers, not yours.
What happened, in order
Sunday 11 October, afternoon: a cybersecurity incident is detected. The group does not describe an outage it suffered but a decision it took, to put certain systems offline in order to protect them[4]. Down went the websites and apps, customer service, the loyalty programmes and, above all, the logistics systems[2].
Monday 12 and Tuesday 13 October: tills in the stores keep working, but electronic shelf labels show last week's prices, and online orders already placed are cancelled with compensation promised[4][5]. In Belgium, the 88 Albert Heijn stores are supplied from substitute distribution centres instead of Tilburg, with reduced stock; Delhaize keeps delivering by estimating orders from purchase history rather than from what stores actually requested[3].
Wednesday 14 October, 11:20: the first distribution centres restart operationally; by 18:20 all of them are running[2]. Thursday 15 October, 10:30: regular deliveries are restored nationwide, and the group maintains that at this stage there is no indication that customer or employee data is involved, with the investigation still open[2]. Online ordering and home delivery, however, remained suspended at least until 18 October[2].
On that same Tuesday 13 October, the NCSC published its statement on incidents in the European food sector and repeated that organisations in critical sectors must report significant incidents to their sector CSIRT and to the supervisory authority, precisely so that other companies are warned in time[1].
What it changes for an SME supplier
Three mechanisms run at the same time, and none of them is about your own security.
First, orders stop arriving. When EDI and the supplier portal are off, nobody orders from you, while your customer still needs goods: it orders from history[3]. You are producing against a forecast that is not yours.
Second, you cannot invoice. If a portal is your only invoicing channel, the portal going down shifts the filing date of the invoice, and therefore the payment due date, by the full length of the outage.
Third, fresh produce does not wait. A batch prepared for a delivery postponed by three days is not postponed; it is lost.
The decision nobody prepares: switching off
The most instructive detail of the week is the nature of the shutdown: it was preventive. On a Sunday afternoon, someone had the authority to stop a retailer's logistics in two countries. In most SMEs, that authority is written down nowhere.
Ask three questions before you need the answers. Who may decide to pull the plug on a Sunday, without waiting for the owner? In what order do you bring things back: the recovery was described in the trade press as ad hoc and uncoordinated[5], which is the usual criticism when the restart order has never been written down. And how do you keep trading meanwhile: at Delhaize the answer was an estimate based on purchase history[3], a degraded plan B, but a plan B.
It is the same reasoning as a breach at a provider. We set it out in detail in our piece on the 72-hour notification deadline when the breach happens at a processor, and in the one on the Flink breach that started from a former employee's account. The weak point is almost never your firewall: it is somebody else's account, link or portal.
Who to notify, country by country
Two separate duties can be triggered, with different recipients and different clocks. If personal data is involved, the GDPR requires the controller to notify the data protection authority within 72 hours under Article 33[6]: Autoriteit Persoonsgegevens in the Netherlands, APD/GBA in Belgium, the CNIL in France, the CNPD in Luxembourg. If your company is in scope of NIS2, add the significant-incident report, with an early warning within 24 hours and a notification within 72 hours under Article 23 of the directive[7]: in practice the NCSC and the sector CSIRT in the Netherlands[1], the CCB in Belgium, ANSSI in France, the ILR in Luxembourg. Check your own position before an incident, not during one.
Food is one of the sectors concerned. If you produce, process or distribute food in the Netherlands, start with our page on NIS2 in the Netherlands for the food sector.
- List your three largest customers and your three critical suppliers. For each, write one line on what you do if they are unreachable for five days.
- For each, get an out-of-band contact: name, mobile number, and an email address that does not depend on their domain. A portal that is off has no phone number.
- Check that you can invoice without their portal: a PDF invoice carrying the purchase order reference, and read what your contract says about payment terms when the portal is unavailable.
- Write down, in three lines, who has the authority to shut your systems down outside office hours, and in what order you restart.
- Check that no admin interface, no controller and no remote access of yours is reachable from the internet. Our supplier security questionnaire also works as a self-audit.
- Put the reporting contacts for both authorities that apply to you, data protection and NIS2, on a single page, with their deadlines.
At CyberNovaLabs.io
We help SMEs in the Netherlands, Belgium, France and Luxembourg write that plan before the incident: dependency mapping, degraded-mode continuity, supplier questionnaires, and NIS2 and GDPR reporting prepared in advance. Our cybersecurity pages set out the detail. If you want to know what stops at your company when a large account goes dark for four days, book a meeting: an hour is enough to produce the list and the two gaps to close. Services quoted on request.
Sources
- NCSC (Pays-Bas) — In het nieuws: Cyberaanvallen op levensmiddelensector (13/10/2026)
- Albert Heijn — Mediastatement inzake cybersecurity incident, mises a jour du 11 au 15/10/2026
- VRT NWS — Albert Heijn en Delhaize herstarten systemen na cybersecurityincident (13/10/2026)
- RetailDetail — Groot cyberincident bij Ahold Delhaize (12/10/2026)
- ICT Magazine — Cybersecurity-incident bij Albert Heijn raakt nu ook toeleveringsketen en winkels (12/10/2026, mis a jour le 13/10)
- RGPD (reglement UE 2016/679), article 33 — notification d'une violation a l'autorite de controle
- Directive NIS2 (UE) 2022/2555, article 23 — obligations de signalement
Qualified meetings, no lock-in.
Criteria in writing before launch, pay per meeting or monthly, stop with a simple email.
Read next
Critical PHP flaws: your website is affected (21/10/2026)
Two critical vulnerabilities in PHP, the engine under most small-business websites, allow unauthenticated remote code execution. Patches shipped on 21 October 2026. What to check this week, and what will never be fixed.
Read the article →October 22, 2026 · 9 min readNIS2 Netherlands: are software vendors and IT providers in scope?
Publishing software is not a listed category in Dutch law. Running a client's infrastructure, hosting it, monitoring it, is. Here is how to settle your own case in ten minutes, with the Dutch dates, the right regulator and the main-establishment rule that decides who inspects you.
Read the article →October 18, 2026 · 7 min readB2B appointment setting for accounting firms and fiduciaries
Two very different briefs hide behind "I want meetings with accountants": selling to firms, or being a firm that needs clients. The first runs into a calendar set by law. The second runs into a professional code that governs both promotion and taking over a colleague's engagement. Both are covered here.
Read the article →October 17, 2026 · 8 min readNIS2 Netherlands: are estate agents and letting firms in scope?
The Dutch Cybersecurity Act has applied since 15 August 2026 to some 8,000 organisations. Real estate is not among them. What does bind you: the Wet goed verhuurderschap, client questionnaires, and the ICT provider you share.
Read the article →October 16, 2026 · 7 min readB2B appointment setting: 7 levers that cut no-shows
No ghosts in your calendar. A missed B2B meeting costs the prep, the slot and the follow-up. Here are 7 levers to cut your no-show rate, and what the public evidence does — and does not — let you expect.
Read the article →October 16, 2026 · 9 min readNIS2 France: are law firms in scope?
Legal services are absent from Annexes I and II of NIS2, and France had not finished transposing as of 16 October 2026. Yet the directive reaches firms through their in-scope clients' supply chain, through the GDPR and through CARPA transfer fraud. Here is what is enforceable today, and in what order to act.
Read the article →