Albert Heijn recovery underway as cyberattack damage likely tops €10 million

Albert Heijn expects all of its distribution centres to be operational again over the course of Wednesday. “This is a positive step forward in restoring our supply chain,” the supermarket chain said in an update on the problems caused by a cybersecurity incident that has persisted for days. The incident has cost Albert Heijn around 10 million euros, experts say.

Albert Heijn has resumed its usual deliveries of non-perishable goods to stores but has yet to restore regular shipments of fresh products. The supermarket chain is continuing to work on that process, while its website remains unavailable following the cybersecurity incident.

Albert Heijn has cancelled all online orders scheduled for delivery up to and including Thursday. Customers who have already paid for their orders will be refunded directly to their bank accounts.

Several Albert Heijn stores were running increasingly low on stock on Wednesday, with the most noticeable shortages in the fruit and vegetable aisles, ANP reporters observed. Albert Heijn says customers can continue shopping at its stores for their daily essentials. “Deliveries are gradually returning to normal. Product availability may still vary between stores and product categories.”

The investigation into the cause and nature of the cybersecurity incident is still underway, Albert Heijn said. The retailer again stressed that it has found no evidence so far that the incident resulted in customer or employee data being stolen.

Industry experts estimate that the cyber incident has already cost Albert Heijn at least 10 million euros in financial losses. This figure does not include the additional expense of bringing in IT specialists to help resolve the disruption.

Cor Molenaar, emeritus professor of e-marketing at Erasmus University Rotterdam, estimates the damage at around 10 million euros. “But those losses could increase exponentially the longer it takes,” Molenaar said.

Retail expert Erik Hemmes estimates that Albert Heijn has lost approximately 21 million euros in revenue from its stores and online sales since the cyber incident began.

Molenaar suspects Albert Heijn was the target of a distributed denial-of-service (DDoS) attack, rather than a hack. Such an attack overwhelms a system with internet traffic until it can no longer operate normally. A hack, by contrast, involves gaining unauthorized access to a computer, network, or system, potentially to steal information. “I don't think that happened. They were attacked from multiple computers,” Molenaar said.

Molenaar also cautions against the impression that all Albert Heijn stores are facing empty shelves. “Deliveries of fresh products have been disrupted, but many items are still available. Staff are doing everything possible to keep stores supplied as well as they can by using alternative routes,” he said.