Ahold Delhaize Kept Shops Open
Physical trading and digital availability are separate questions.
Ahold Delhaize reported a network security incident on 12 October. It switched off some systems protectively while keeping shops trading.
What the notices confirmed
The first statement was issued from Zaandam on 12 October at 08:29 Europe/Amsterdam, describing a protective shutdown.
Update, 15 October 2026: The 13 October follow-up, marked updated 14 October, described a controlled return of selected systems while investigations continued. It reported no evidence of customer, staff or partner data theft, not a final forensic finding. European and US shops were open, with disruption varying by brand. Neither notice identified an actor, access route or ransomware.
That distinction matters beyond the shop door. A supplier can still be unable to confirm an order even when a customer can buy something in person. Treat each digital dependency as a separate question, not as a conclusion drawn from physical trading or a general recovery statement.
Update, 1 November 2026: confirmed attack and customer services
In its 19 October statement, Ahold Delhaize confirmed that the suspicious activity resulted from malicious actions. It filed a formal report with Dutch police that day and said it had notified the Dutch National Cyber Security Centre within 24 hours of discovering the malicious activity. The statement does not establish when the initial intrusion took place.
That statement put Albert Heijn’s website and app back online, with home deliveries expected from 23 October. It said Etos and Gall & Gall websites were available, Belgian e-commerce was operational and most Central and Southeastern European brand sites and apps were available. US e-commerce was then expected back in the following days. Those are the position and expectations reported on 19 October, not confirmation that every service is now restored. The company then had no evidence that sensitive customer, staff or partner data had been taken, while the investigation continued.
Albert Heijn’s customer FAQ, read on 1 November, now says customers can place online orders again and delivery is available to all customers. Available slots remain limited and some products may still be missing. Customer service cannot add or reserve extra slots. The page is undated, so it does not establish the day each service returned or the position at other group brands.
The same FAQ says prepaid cancelled orders paid through iDEAL or the digital payment card have been refunded, and Koopzegels used on undelivered orders have been restored. It describes €10 towards a future order for customers whose orders were cancelled between 11 and 22 October, and for Bezorgbundel customers unable to receive an order during that period. This credit is separate from repayment of the original purchase price. Check your own balance, payment and delivery slot through the established brand channel; BlackTree has not verified individual refunds or orders.
The newer instructions replace the delivery restrictions and refund waiting times in the FAQ as it stood earlier in October. They are evidence of specific customer services returning, not a final forensic all-clear. They do not establish an attacker, access route, ransomware family or stolen-password finding. Continue to check the exact function you depend on before withdrawing a continuity arrangement.
Check the exact dependency before changing course
Customers should use the relevant brand’s established service channel to confirm whether a specific online or account function is available. Avoid treating an unverified social post or unexpected message as a recovery notice.
Suppliers and logistics partners should name their dependent workflows, then test only the necessary path through an established contact. Record failure times, error messages and transaction references. That evidence will make later reconciliation easier without assuming the cause.
Prepare a reversible continuity path
Use approved manual ordering, fulfilment or invoicing procedures where they already exist, with an owner, expiry point and reconciliation step. Do not create an improvised channel that bypasses identity or payment checks.
Verify any changed delivery, account or bank instruction with a known contact before acting. Opportunistic phishing can imitate a real incident. Continue to follow the victim’s notice for confirmed scope and recovery updates.
Sources: 12 October notice; 13 October follow-up, updated 14 October; 19 October company statement; Albert Heijn customer FAQ, read 1 November.
