Albert Heijn cyber incident: What it means for your groceries, Bonus card and data

If you opened the Albert Heijn app on Monday and saw nothing but an error message, you now know why. The supermarket chain — along with sister brands Etos and Gall & Gall — has been offline since Sunday evening after what parent company Ahold Delhaize first called an "IT incident" and then upgraded to a "cybersecurity incident."

Ahold Delhaize took "the temporary, precautionary shutdown of several systems" after detecting a security issue, Albert Heijn said in a statement. That shutdown has real consequences beyond a dead website. Online orders are not being accepted, the Albert Heijn app is down, and customer service can't be reached. In stores, electronic price tags may still show last week's promotions while the till rings up the current price, and the Bonus card system is offline, meaning personalized discounts may not apply.

Experts: "very likely" a cyberattack

As of Tuesday, Albert Heijn has not formally confirmed a hack. But cybersecurity experts are not waiting for the official word. "An organization of this size doesn't take such drastic measures without good reason," Joey Fennis told NOS, as reported by NL Times. "If malicious actors have turned the key in the front door lock, they may well have looked inside and accessed or stolen data."

Pim Takkenberg echoed that in an interview with Nieuwsuur: "It seems quite clear to me that a malicious actor has been inside the system." He noted that shutting down systems preventively is the textbook response to an active breach. Fennis compared the situation to last year's hack at the Dutch Public Prosecution Service (Openbaar Ministerie, or OM), which kept that agency offline for months.

No evidence of data theft so far

If you're worrying about your personal data: Ahold Delhaize said on Tuesday afternoon that it has found no evidence so far that customer, employee, or third-party data was stolen. The investigation is ongoing and the company is working with external cybersecurity experts and "competent authorities," according to NL Times. Some systems have already been brought back online, but the company said it won't share more details that "could compromise security measures or hinder our response."

Still, "no evidence so far" is not the same as "no theft." If you use the same password for your Albert Heijn account elsewhere, it's a good moment to change it — and to keep an eye on your bank statements, especially if you use automatic payments.

Practical impact: empty shelves and delayed deliveries

The outage is also hitting supply chains. Several distribution centres ground to a halt, leaving some Albert Heijn stores with empty shelves and sending customers to competitors, NL Times reports. Exactly when services will be fully restored is unknown; Albert Heijn says it will share updates as soon as it has them.

For those of us who live in the Netherlands on a residence permit, none of this affects your immigration status — but it does affect your week. If you depend on Albert Heijn for groceries, this week is a good time to check the shelves at Jumbo, Lidl, or your local market instead. And if you're entitled to a discount via your Bonus card, don't be surprised if the cashier can't apply it — ask, but be patient.

The National Cyber Security Centre (NCSC), the Dutch government's cybersecurity agency, said it currently sees no reason to link this incident to other recent attacks on the European food sector, including the sabotage of supermarket refrigerators in France. That's small comfort if you were hoping for a straightforward explanation. For now, the message from Ahold Delhaize is: investigations continue, systems are coming back, and apologies are being offered.