CADChain Blog

Albert Heijn Hack: Deep Technical Dive into the Ahold Delhaize Cyber Incident (October 2026) | CADChain | CAD DRM & IP

The tills kept beeping. The shelf labels kept showing last week's prices. And behind the scenes, the machine that moves food to more than a thousand Dutch supermarkets stopped.
On Sunday afternoon, 11 October 2026, Albert Heijn, the largest supermarket chain in the Netherlands, hit what it first called an "IT incident". By Monday morning it was a "cybersecurity incident", and parent company Ahold Delhaize confirmed "a security issue within its network". Websites and apps of Albert Heijn, Etos and Gall & Gall went dark, online delivery stopped, customer service went silent, and most of Albert Heijn's distribution centres stopped working. In the US, the websites of Food Lion, Stop & Shop, Giant Food, The Giant Company and Hannaford went down at the same time.
This is the second major incident at Ahold Delhaize in under two years, after a ransomware attack on its US business in November 2024. I wrote this the same way I wrote our Vercel breach deep dive: what is confirmed, what the outage pattern tells us technically, what is still speculation, and what founders and suppliers should do this week.
TL;DR: the Albert Heijn hack in one paragraph

Ahold Delhaize detected a security issue on Sunday 11 October 2026 and shut down systems across the group as a precaution. In the Netherlands that took out the Albert Heijn, Etos and Gall & Gall websites and apps, online delivery, customer service, personal Bonus discounts and most distribution centres; stores stayed open and tills kept working. US banner websites and internal tools went down too. The company has not named the cause, said whether data was stolen, or confirmed ransomware, but the pattern (group-wide, simultaneous, "precautionary" shutdown of identity-dependent systems) matches ransomware containment, and the company was hit by the INC Ransom group in 2024. Below: the full timeline, a system-by-system technical reading, the ransomware playbook behind incidents like this, the Dutch reporting clocks under the new Cyberbeveiligingswet, and a checklist for startups and suppliers.

What happened at Albert Heijn: the timeline

Here is what has been reported so far, in order. Everything in this table comes from the company or from named Dutch, Belgian and US news outlets on 11 and 12 October 2026.
WhenWhat happenedStatus
Sunday 11 Oct, afternoonAlbert Heijn says an incident starts; systems are shut down "to protect the IT environment"Confirmed by Albert Heijn
Sunday 11 OctDelivery drivers are all logged out of their app at the same moment and cannot log back inReported by a driver to NOS
Sunday 11 OctA Food Lion memo in the US describes an "IT outage" in which stores may be unable to shop, stage or hand off ordersInternal memo reported by US media
Monday 12 Oct, earlyAlbert Heijn reports an "IT incident"; ah.nl, the app, Etos and Gall & Gall are offlineConfirmed
Monday 12 Oct, morningAhold Delhaize publishes a press release: "a security issue within its network", some systems taken offline "to help protect them"Confirmed
Monday 12 Oct, morningWebsites of the five Ahold Delhaize USA banners are down; Delhaize Belgium stops online orders and customer serviceConfirmed by outlets and Delhaize
Monday 12 Oct, 11:30Albert Heijn upgrades the wording to "cybersecurity incident"Confirmed
Monday 12 Oct, afternoonCEO Margaret Versteden-van Duijn confirms that work at some distribution centres has stopped completely; empty shelves possible, fresh produce firstConfirmed to NOS
Monday 12 Oct, afternoonSuppliers are told to deliver only to the automated DC in ZaandamReported by RTL Z, not confirmed
Two things are notably not confirmed: whether attackers actually got inside the IT systems (Albert Heijn said it could not yet say), and whether any customer or employee data was taken. Albert Heijn says protecting the data of customers, employees and partners is its top priority, which is the standard wording companies use before they know the answer.

What went down and what kept working

The most useful technical evidence in the first 48 hours of any incident is the pattern of what fails and what survives. Companies say little; their systems say a lot.
SystemStatusWhat it suggests technically
Websites and apps (AH, Etos, Gall & Gall)DownTaken offline deliberately; public front ends are the first thing a containment team cuts when it cannot trust the back end
Delivery driver appAll drivers logged out at onceCentral session or token revocation: the classic first move when credentials may be compromised
Tills and national promotionsWorkingStore point-of-sale runs on locally cached price files and can operate offline for days
Personal Bonus discounts, app stampsDownPersonalised offers are calculated centrally per customer and need the loyalty platform online
Electronic shelf labelsShowing last week's offersThe weekly price and promotion feed did not run, so labels froze on the previous cycle
Most distribution centresStoppedWarehouse systems depend on central order, stock and transport data; without it, picking at scale stops
Automated DC ZaandamReportedly runningPossibly a separately segmented control stack; unconfirmed
US: Spectrum picking platform, Kronos Dimensions schedulesDownShared group services or a shared identity layer reach across the Atlantic

Reading the signals: what the outage pattern tells us

Group-wide and simultaneous. Albert Heijn in the Netherlands, Delhaize in Belgium and the US banners all lost systems on the same weekend. That rules out a single faulty app or a local network fault. What spans all of them is shared infrastructure: identity (Active Directory or a cloud identity provider), shared data centres, shared ERP or supply chain platforms, or shared security tooling. When defenders believe an attacker holds domain-level or cloud admin credentials, the only safe move is to disconnect everything that trusts those credentials.
"Precautionary shutdown" is a containment step, not a cause. In ransomware cases, incident responders cut network links between sites, disable remote access, reset privileged accounts and isolate virtualisation hosts before encryption can spread or finish. The visible damage, such as empty shelves, often comes from the containment itself rather than from the attacker. In November 2024, Ahold Delhaize used almost identical words, and it later turned out to be ransomware with data theft.
Tills up, loyalty down. Supermarket point-of-sale systems are designed to keep selling when the head office link drops; each store holds a local price file. Personal Bonus offers, app stamps and online orders cannot work that way. This split tells you the stores were deliberately kept on the safe side of the cut.
The distribution centres are the real story. A modern grocery DC runs on a warehouse management system fed by central replenishment: store orders, stock levels, slotting, transport plans and supplier bookings. Cut the link to the central platform and the warehouse does not know what to pick, where to send it or which supplier truck is arriving. Paper fallback works for a small depot, not for a site shipping fresh food to hundreds of stores every night. That is why the CEO, speaking to NOS, warned that fresh produce would run short first, and why long-life products, bread and frozen goods held up better.
Why one DC might keep running. If the RTL Z report is right and only the automated Zaandam DC kept operating, the likeliest explanation is that its automation and control systems sit in a separate, more isolated network zone. That is speculation until Albert Heijn says more, but it is exactly the lesson every operations team should take away: segmentation decides which parts of your business survive a containment shutdown.

Who is behind the Albert Heijn hack?

Nobody has been confirmed. Ahold Delhaize has not named an attacker or used the word ransomware. Experts quoted by Information Security Media Group suspect ransomware. Security researcher Kevin Beaumont said the incident "started a week ago" and that the company "again didn't say ransomware"; that timing has not been confirmed by the company. One trade outlet reported that the INC Ransom group had claimed the attack, but it is unclear whether that refers to this incident or to the 2024 one, so treat it as unverified.
The history matters. In November 2024, files were taken from an internal repository of Ahold Delhaize USA on 5 and 6 November. INC Ransom later listed the company on its leak site and published data, and the company told US regulators that 2,242,521 people were affected, mostly current and former employees. The first public statement then also spoke of a "cybersecurity issue" and systems taken offline.

What INC Ransom attacks typically look like

If this does turn out to be the same group, or a similar double-extortion crew, the techniques are well documented in the MITRE ATT&CK profile of INC Ransom. Mapping them to detection ideas is the most useful thing a defender can do while the facts settle:
StageTypical INC Ransom techniqueWhat to watch for
Initial accessSpear-phishing; stolen credentials for VPN and remote desktopLogins from new countries or ASNs, MFA fatigue prompts, new VPN devices
FootholdAnyDesk and PuTTY on compromised hosts; the encryptor installed as a Windows serviceNew remote-management tools, service creation (event 7045) with innocent names
Credential accessDumping Active Directory data, for example with esentutl on the NTDS databaseAccess to NTDS.dit or volume shadow copies on domain controllers
Lateral movementRDP and PsExec with stolen admin accountsAdmin logons to many hosts in a short window, PsExec service names
ExfiltrationBulk upload to MEGA with MegaSyncLarge outbound transfers to cloud storage from servers that never talk to it
ImpactEncryption of servers and virtualisation hosts, deletion of backups, leak-site extortionMass file renames, shadow copy deletion, hypervisor shell access
The uncomfortable part is dwell time. In the 2024 case the data left the network days before anyone outside knew, and the leak came months later. Disclosure is when you hear about an attack, not when it started.

The same weekend: French supermarket fridges heated to 50°C

On the night of 11 to 12 October, attackers took control of refrigeration controllers in hundreds of French supermarkets and ran defrost cycles at around 50°C for hours. Intermarché owner Les Mousquetaires reported about 150 affected stores, Carrefour 80, and Monoprix about 5 percent of its stores. French reporting says the national cyber agency ANSSI linked the attack to a vulnerability in Danfoss refrigeration management software, and the Paris prosecutor opened an investigation.
Albert Heijn's CEO could not say whether the two incidents were linked, and an Ahold Delhaize spokesperson told Reuters there was no reason to link them. The technical profiles are very different: the French attack hit operational technology (fridge controllers exposed to the internet), while the Dutch outage looks like an IT incident on business systems. But together they make one point brutally clear: food retail is now a target for attackers who want physical disruption, not only data.

Dutch food retail has been here before

IncidentWhenWhat happenedLesson
Bakker Logistiek (supplier to Albert Heijn)April 2021Ransomware, suspected via Microsoft Exchange flaws; the firm switched to pen and paper and pre-packed cheese ran short for about a weekYour supplier's IT is part of your shelf availability
Ahold Delhaize USANovember 2024INC Ransom stole files from an internal repository; 2.2 million people affected; US websites and pharmacy services disruptedPrecautionary shutdowns can hide data theft that surfaces months later
Bun, Albert Heijn's largest franchiseeOctober 2025The ThreeAM ransomware group stole and published staff files, including passport copies and salary dataFranchisees and partners hold sensitive data outside the parent's controls
Ahold Delhaize groupOctober 2026Group-wide security issue; websites, apps, delivery and most Dutch DCs offlineShared platforms mean shared blast radius
If you want to see how another large Dutch breach played out technically this year, read our breakdown of the Odido data breach. And for the public sector version, see what the European Commission hacks teach startups.

The reporting clocks: Cyberbeveiligingswet, GDPR and market rules

This is the first major Dutch incident since the Cyberbeveiligingswet, the Dutch version of the EU NIS2 directive, came into force on 15 August 2026. Food production, processing and distribution is one of the sectors it covers. For organisations in scope, the clocks look like this:
RuleWhoDeadlineWhat it requires
EU Market Abuse RegulationListed companies such as Ahold DelhaizeAs soon as possiblePublish inside information that could move the share price; the Monday press release is that disclosure
Cyberbeveiligingswet (NIS2)Essential and important entities, including large food distributors24 hours, 72 hours, 1 monthEarly warning, incident notification, then a final report with root cause and measures
GDPR Article 33Any organisation processing personal data72 hoursNotify the Autoriteit Persoonsgegevens if a breach is likely to put people at risk
GDPR Article 34SameWithout undue delayInform affected people directly if the risk to them is high
For startups the GDPR clock is the one that bites: it starts when you have reasonable certainty that personal data was affected, not when the investigation is finished. If a supplier or platform you use is breached and your customers' data sat in it, you may have your own notification duty. Our GDPR compliance guide explains how this applies to technical files and design data.

What this means for European startups and suppliers

I have built CADChain and Fe/male Switch with small teams between the Netherlands and Malta, and the honest reaction of most founders to news like this is "we are too small to be a target". That misses the point twice. First, you are almost certainly part of someone's supply chain, and when your biggest customer goes dark, your trucks, invoices and forecasts go dark with it. Second, attackers do not pick targets by size; they pick them by weak access. A supplier with a shared login to a retailer's portal is often the easiest door in.

If you supply Albert Heijn or Ahold Delhaize

  1. Follow delivery instructions only from known contacts. Instructions such as "deliver only to Zaandam" are exactly the kind of message criminals copy in the days after an incident. Confirm by phone through a number you already have.
  2. Watch for invoice and bank-detail fraud. Any request to change payment details during an incident is suspect until verified through a second channel.
  3. Rotate shared credentials. If you log into any retailer portal, EDI service or shared file platform, change the password and check that MFA is on.
  4. Plan for a long tail. Order volumes, payment runs and forecasts will be disrupted for weeks after systems return. Talk to your bank before cash gets tight.

If you are a founder of any tech or hardware company

  1. Know your blast radius. List every system that shares one identity provider or admin account. That list is what goes down together if those credentials are stolen.
  2. Design an offline mode. Albert Heijn's tills kept working because they were built to. Decide which of your critical processes must survive a cut to the central platform, and test it.
  3. Make session revocation a button. Being able to log every user and integration out in one move, as happened to the delivery drivers, is a containment capability you should have before you need it.
  4. Keep immutable, offline backups of the data you cannot rebuild, and rehearse a restore. Ransomware crews look for backups first.
  5. Segment operational systems. Production lines, warehouse automation and anything physical should not trust the office network.
  6. Write the first statement now. "IT incident" became "cybersecurity incident" within hours at Albert Heijn. Prepare honest holding statements, a contact list for regulators and a decision log template before a crisis.
  7. Check whether you are in scope of the Cyberbeveiligingswet, or whether a customer in scope will push its requirements down to you through contracts.
For the access-control side of this, see our guide to zero-trust file distribution, and the EU age verification hack breakdown shows how quickly weak design gets exploited.

If you shop at Albert Heijn: the scam wave is next

Albert Heijn asked customers to keep their receipts so it can compensate missed personal Bonus discounts later. Criminals will use exactly that. Expect texts, emails and WhatsApp messages about "your Bonus compensation", "verify your account after the hack" or "a refund for missed discounts" with a link. Do not click them. Use the Albert Heijn app or ah.nl directly once they are back, never give bank details or passwords through a link, and treat any message that creates urgency as a scam until proven otherwise.

The part nobody talks about: stolen files and intellectual property

Modern ransomware is double extortion: attackers copy data first and encrypt second, so that restoring from backup does not end the threat. For a retailer that means staff records and supplier contracts. For an engineering or hardware company it means the crown jewels: CAD models, drawings, recipes, firmware and tooling designs. Once those are on a leak site, no backup brings them back, and your trade secret protection may be lost because the information is no longer secret.
That is why we built CADChain to protect design files at the file level, not just the network level: files stay encrypted and access-controlled wherever they travel, every access is logged, and ownership is anchored with a tamper-proof record. A stolen file that cannot be opened is a much smaller problem. Read our guides to ransomware protection for engineering firms, CAD file security in the supply chain and the 8-layer IP protection playbook.
Make stolen design files worthless. CADChain's BORIS plugins for SolidWorks, Autodesk Inventor and Blender encrypt and certify your CAD files inside the tools your engineers already use, control who can open them, and keep a verifiable record of every version. If attackers copy your files, they get locked data instead of your product.

👉 Protect your CAD files with CADChain

Mistakes this incident exposes

  • Treating identity as plumbing. One identity layer across countries and brands is efficient until it is the thing you have to switch off.
  • No designed offline mode for logistics. Stores could sell; warehouses could not ship. Fresh food has hours of slack, not days.
  • Vague first statements. "IT incident" today, "cybersecurity incident" a few hours later. Customers and suppliers notice, and attackers use the confusion for phishing.
  • Ignoring the history. A company hit by ransomware in 2024 is a known target in 2026. Attackers keep lists, and initial-access brokers resell old footholds.
  • Forgetting partners. Franchisees, logistics firms and suppliers hold sensitive data and access too, as the Bun and Bakker Logistiek cases showed.

What happens next

Expect a staged restart: first the systems that move food (warehouse and transport), then stores' pricing feeds, then customer-facing channels such as the app, delivery and personal Bonus offers. If this is ransomware with data theft, the next signal will come from a leak site or from notification letters, possibly weeks or months from now, as in 2024. Watch for the company's statements under the Market Abuse Regulation and for any notice to affected people under GDPR. Until then, act on what is confirmed, plan for the worst case, and do not fall for the scam messages.
This article reflects what was publicly known on 12 October 2026 and will be updated as the investigation develops. It is general information, not legal advice.

FAQ: the Albert Heijn hack

Was Albert Heijn hacked?

Albert Heijn and its parent Ahold Delhaize confirmed a cybersecurity incident and a security issue within the group's network on 11 and 12 October 2026, and shut down systems as a precaution. They have not yet confirmed how attackers got in, whether ransomware was used, or whether data was stolen.

Why are Albert Heijn's website and app down?

The company took them offline deliberately to protect its IT environment while it investigates. Etos, Gall & Gall, Delhaize Belgium's online orders and the US banner websites were affected in the same way.

Will there be empty shelves at Albert Heijn?

Possibly. Work stopped at several distribution centres. Albert Heijn expects frozen goods, bread and long-life products to stay better available than fresh produce such as fruit and vegetables. Availability differs per store.

Was my personal data stolen in the Albert Heijn hack?

That is not known yet. The company says protecting customer, employee and partner data is its top priority. If personal data was affected and puts you at high risk, it has to inform you under GDPR.

What happens to my Bonus discounts?

National offers still apply at the till, but personal Bonus discounts and app stamps do not work during the outage. Albert Heijn asks customers to keep receipts so it can compensate them later. Beware of messages offering compensation through a link.

Is the Albert Heijn hack ransomware?

Not confirmed. Experts suspect ransomware because of the group-wide precautionary shutdown, and Ahold Delhaize was hit by the INC Ransom group in 2024. A claim of responsibility has been reported but not verified.

Is the Albert Heijn incident linked to the French supermarket fridge attack?

There is no evidence of a link. The French attack hit refrigeration controllers through a vulnerability in Danfoss software, while the Dutch outage involves business IT systems. An Ahold Delhaize spokesperson said there is no reason to link them.

What should suppliers to Albert Heijn do now?

Verify every delivery or payment instruction through a known contact, change passwords for any shared portal or EDI access, turn on MFA, watch for invoice fraud and plan for disrupted orders and payments for several weeks.

What can startups learn from the Albert Heijn hack?

Map which systems share one identity layer, design an offline mode for critical operations, be able to revoke all sessions in one step, keep offline backups, segment operational systems and prepare incident statements and regulator contacts in advance.
2026-10-12 21:30 Startup Life