Albert Heijn outage very likely a cyber attack, experts say

Cybersecurity experts consider it very likely that the “cybersecurity incident” at Albert Heijn was a cyberattack. Hackers likely broke into parent company Ahold Delhaize’s systems, experts told NOS and Nieuwsuur.

So far, Albert Heijn has not confirmed whether a hack has occurred, first speaking of an “IT incident” and then later of a “cybersecurity incident.” Parent company Ahold Delhaize has taken multiple systems offline as a precautionary measure.

As a result, Albert Heijn, Etos, and Gall & Gall have been offline since Sunday afternoon, causing major problems in stores. Online grocery orders can’t be delivered, electronic price tags in stores are showing the wrong prices, and operations at some distribution centers have ground to a halt, leaving stores facing empty shelves and customers going to competitors for their groceries.

“An organization of this size doesn’t take such drastic measures without good reason,” cybersecurity expert Joey Fennis told NOS. “If malicious actors have turned the key in the front door lock, they may well have looked inside and accessed or stolen data.”

Measures like taking systems offline are typically taken in such scenarios. They also usually require authorization from senior management, Fennis said. “The level of concern is clearly high. It reminds me of the Public Prosecution Service (OM) incident last year.” The OM was offline for months after hackers broke through a vulnerability in software used by employees working from home. The OM is still recovering from that incident.

The drastic action also makes cybersecurity expert Pim Takkenberg suspect that this is more than a technical glitch. "It seems quite clear to me that a malicious actor has been inside the system. Albert Heijn has proactively shut down several systems—a very common step to prevent further damage when someone has breached your network," he told Nieuwsuur. “An outage doesn’t usually last this long.”

Cybersecurity expert Eward Driehuis raised another possibility - that Albert Heijn discovered a vulnerability in its own system and shut down its digital doors while fixing it. "What is becoming clear is just how dependent we are on IT and the cyber domain—even people who don't work with it daily," Driehuis said to NOS. "That becomes very tangible when you can't do your grocery shopping. It serves as a real eye-opener for people."