Cyber attack at Albert Heijn: what can a small business learn?

On 12 October 2026 Ahold Delhaize reported a security issue within its network. As a precaution it took some systems offline. Its stores stayed open (Ahold Delhaize press release ↗ (opens in new tab)). In the Netherlands the websites and apps of Albert Heijn, Etos and Gall & Gall could not be reached. According to TPO ↗ (opens in new tab), couriers were already locked out of their app on Sunday 11 October, and on Monday some distribution centres shut down completely. Shelves were empty in some stores.

By 14 October the distribution centres were running again and long-life products were back in the stores. Fresh products took longer. Personal discounts, loyalty stamps and Air Miles were unavailable for a while and customer service could not be reached (Dutch IT Channel ↗ (opens in new tab)). On 17 October Albert Heijn said home delivery would stay suspended until at least Tuesday 20 October (NL Times ↗ (opens in new tab)).

On 13 October Ahold Delhaize wrote that it had no evidence at that moment that customer, associate or partner data had been taken. The investigation was still going on and the company had started a controlled re-launch of some systems (Ahold Delhaize update ↗ (opens in new tab)). At the time of writing, nobody knows who is behind it. According to the Dutch police and public prosecutor, the company reported the incident to the NCSC within 24 hours, as the Dutch Cybersecurity Act requires.

It was not the first time. In November 2024 Ahold Delhaize also took systems offline, that time in the United States. A number of pharmacies and online shops were affected. Supermarket chain Hannaford cancelled pickup and delivery orders (Cybersecurity Dive ↗ (opens in new tab)). It later turned out that files had been stolen on 5 and 6 November 2024. In June 2025 the company told the Maine Attorney General that data on 2,242,521 people was involved, mostly current and former employees. It included Social Security numbers, bank account numbers and health information from employment records (Security Affairs ↗ (opens in new tab)).

Ahold Delhaize is not alone. Four examples with well-documented consequences:

You don't run distribution centres or car plants. The problems in the first days look alike though, and in a business of ten people you feel them sooner:

• Systems go down, sometimes because of the attacker and sometimes because you switch them off yourself to stop it getting worse. Then you can't invoice, plan or open your customer files.
• Your email and shared folders can't be trusted or can't be reached. Your IT partner's phone number is in Outlook, and you can't get to it.
• Nobody knows who decides. Can you shut down the server? Do you call the customer? Do you pay a ransom? Who talks to the press or the insurer?
• Meanwhile the reporting deadlines are running. For a personal data breach you have 72 hours. If your business falls under the Dutch Cybersecurity Act, you have 24 hours for the first report.
• The problem can also sit with a supplier, as it did for the airports. Then you have to carry on without a system you can't fix yourself.

Large companies have playbooks and crisis teams for this. A small business usually has nothing on paper and has to work everything out on the spot.

An emergency plan is a few pages that say who does what when things go wrong. Who decides, who you call, which systems matter most, where the backup is and which reports you have to make. You write it while everything still works and you can think calmly.

Print it. A plan in your shared folder or mailbox is no use when exactly those systems are down, or when you don't know if they are still safe. Keep one copy at the office and one at home with the person who decides. Put phone numbers on it, not links.

This is the short version. The full emergency plan, with fields for your own contacts, is on the printable page.

1. Name one person who decides. Agree in advance who is in charge and who stands in for them. That person decides on shutting down, communication and calling in help. Then nobody has to argue in the middle of the chaos about who is allowed to do what.
2. Take affected devices off the network. Pull the network cable or switch off Wi-Fi. Try not to switch the device itself off, because what is in memory can help the investigation. If in doubt, call your IT partner first.
3. Call your IT partner and your insurer. Use the numbers on your paper list and call from a phone that is not on the company network. If you have cyber insurance, it often has a reporting number you can reach day and night.
4. Write everything down with the time. What you saw, when, who you called and what you did. Do it on paper or on a clean device. You will need it later for the reports, the insurer and the police.
5. Check that your backup is still good. Don't restore anything until you know the backup is clean and the hole is closed. A backup that was also on the network may be encrypted or infected. An offline or immutable copy is then your way out.
6. Work out which reports you must make. Was personal data involved? Then the 72-hour deadline for the Dutch Data Protection Authority is running. Also report the crime to the police, because a report to the NCSC is not a criminal complaint. Tell your customers what is going on, even if you don't know everything yet.

If personal data leaks and there is a risk to the people it belongs to, you report the breach to the Dutch Data Protection Authority (in Dutch) ↗ (opens in new tab) within 72 hours of finding it. If the risk is high, you must also inform the people affected. If you don't know everything yet, report on time anyway and add details later.

The Dutch Cybersecurity Act (the Dutch NIS2 law) has applied since 15 August 2026. If your organisation falls under it, you report a significant incident with an early warning within 24 hours, an incident notification within 72 hours and a final report within one month (NCSC, in Dutch ↗ (opens in new tab)). Our page on the Cybersecurity Act explains who falls under it. Most small businesses don't fall under it directly. If you supply a company that does, that customer can set requirements for your security.

Start with the cyber attack emergency plan. Fill it in, print it and walk through it once with your colleagues. Then do our free IT check to see where the biggest gaps are.

Two topics often decide how quickly you are running again. The first is your backup: is there an offline copy and have you ever tested a restore? The second is basic security such as two-factor authentication, updates and staff awareness.

For some of those measures, Dutch businesses can apply for a subsidy until 30 November 2026. Mijn Cyberweerbare Zaak pays back half, up to €1,250. It covers things like setting up and testing backups, two-factor authentication and staff training. The budget goes first come, first served.