Usually it’s the attackers who switch things off. This time the business did it deliberately, which makes it a useful real-world example of containing an attack. Here’s what has been reported, and what it means for UK small businesses, with no daft jargon.
What happened?
Albert Heijn, Etos (a drugstore chain) and Gall & Gall (a drinks retailer) in the Netherlands say they have been dealing with a cybersecurity incident since Sunday afternoon, 11 October, and took immediate steps to protect their IT, including switching off a number of systems as a precaution (Albert Heijn).
On Monday 12 October, parent company Ahold Delhaize put out a short statement: “Ahold Delhaize is experiencing a security issue within its network. Our teams are taking steps to assess and mitigate the issue. This includes taking some systems offline to help protect them. At this time, our stores are open and serving customers.” (Ahold Delhaize) The group runs more than 9,400 stores across Europe, the US and Indonesia (BleepingComputer).
What customers noticed
At Albert Heijn, Etos and Gall & Gall, websites, apps and customer service went offline. Logistics systems were also switched off, so online grocery orders couldn’t be delivered or placed, and Albert Heijn cancelled all orders already placed, promising to compensate customers who had paid (Albert Heijn).
In the shops, the tills kept working for payments and the national offers from that week’s leaflet still applied. But the electronic shelf labels were still showing the previous week’s offer prices, so the shelf price could be lower than the price at the till. Personal discounts and app-linked savings schemes, including Koopzegels stamps and Air Miles, stopped working. Customers were asked to keep their receipts so missed personal discounts can be made up later (Albert Heijn).
The disruption reached the supply chain too. Albert Heijn’s top executive, Margaret Versteden-Van Duijn, confirmed that work at some distribution centres had stopped completely because systems had been switched off as a precaution. RTL Z reported, based on an email to suppliers, that only the automated distribution centre in Zaandam was still operating (Warehouse Totaal). Albert Heijn warned that fresh fruit and vegetables may be harder to find for a few days, and with customer service unreachable it has been updating customers through social media (Albert Heijn).
In Belgium, Delhaize also took immediate steps to protect its IT. Its stores in Belgium and Luxembourg stayed open, but customers couldn’t place new orders for the week and customer service was unavailable. Delhaize’s app and website stayed online (VRT NWS). By Tuesday, Delhaize deliveries were only available in some time slots (Tweakers).
In the US, the websites of all five Ahold Delhaize USA banners, including Stop & Shop and Food Lion, were down on Monday morning (Grocery Dive), and Stop & Shop staff reported trouble getting to their schedules and pay slips (BleepingComputer).
The latest, and what we still don’t know
On Tuesday morning, 13 October, the Albert Heijn, Etos and Gall & Gall websites and apps were still unavailable, with no date given for restoring them (Tweakers). An Ahold Delhaize spokesperson said the group was “hard bezig” (working hard) on fixing the problem, but wouldn’t say more or when the next update would come (ANP).
The cause hasn’t been made public. Ahold Delhaize told BleepingComputer to refer to its statement when asked whether any devices had been encrypted (BleepingComputer). Dutch police say they are in contact with Albert Heijn but that no criminal offence has been established so far (Hart van Nederland). Some security experts suspect ransomware (BankInfoSecurity), but that is suspicion, not a confirmed finding. It isn’t yet known whether any customer data was accessed (VRT NWS). It is the group’s second major incident since a November 2024 attack on its US systems (BleepingComputer).
Is it linked to the French supermarket fridge attack? Overnight on 11-12 October, attackers forced Danfoss refrigeration controls in hundreds of French supermarkets into a 50°C defrost, which we covered in our earlier piece, “When hackers switched off the cold”. The two incidents hit the same weekend, but they affected different systems, and an Ahold Delhaize spokesperson told Reuters there is no reason to see a link between them (NOS). No source has confirmed a connection.
Why this matters to you: going offline on purpose
Pulling the plug sounds drastic, but it’s often the right call. Cutting off affected systems makes it much harder for an attacker to move around a network and reach the things that matter most, and it buys time to work out what has happened. When the Co-op did the same in April 2025, shortly after the M&S attack, security experts praised it as a mature, proactive response (Computer Weekly). With the French fridge attack and now Ahold Delhaize, retail has had a steady run of incidents.
The catch is that going offline only works if you can keep running without those systems. Ahold Delhaize kept its doors open because the tills still worked. So the real question is: if you had to switch your systems off tonight, what would still work tomorrow morning? The NCSC’s small business guide starts in the same place: work out which systems and processes are critical, and what would happen if you lost access to them (NCSC).
1. Have a business continuity plan, even a short one
A few pages will do: your critical systems (tills, card machines, ordering, email, accounts), what happens if each one goes, and the workaround. Keep a printed copy, with numbers for your IT support, internet, payment provider and insurer, as normal communication may be down during an incident (NCSC).
2. Plan your manual and offline fallbacks
Tills: can you take payment if the till system is down? Keep a printed price list and a paper sales log.
Card machines: ask your payment provider whether yours can run on a mobile SIM if your network is off, and whether it supports offline payments.
Order taking: if your website or booking system goes dark, have a phone line and a paper order pad ready.
Prices: Albert Heijn’s shelf labels got stuck on old offers. Decide in advance whether you honour the lower price.
3. Keep tested backups, with at least one offline
Switching off is one half of recovery; restoring is the other. The NCSC has seen ransomware encrypt not just live data but also connected USB drives, network storage and cloud backups. It recommends the 3-2-1 rule (at least three copies, on two devices, one offsite) plus at least one backup that is offline or digitally disconnected when not in use (NCSC). Immutable (write-once) cloud backups do a similar job. And regularly test that you can actually restore from them (NCSC).
4. Write an incident response plan with clear decision makers
The hardest call in an incident is often “do we switch it off?”. The NCSC uses exactly that example: one person may spot a problem with the website, but who decides whether the website should be shut down? Your plan should say who makes that call, who covers when they’re on holiday, and at what point senior people get involved (NCSC). Then rehearse it. The NCSC’s Exercise in a Box is a free way to practise your response to a cyber attack, and you don’t need to be an expert to use it (NCSC).
5. Communicate early and plainly
Ahold Delhaize’s first statement said three useful things: there’s a problem, we’re dealing with it, and the shops are open. Albert Heijn then told customers what worked, what would happen to cancelled orders, and to keep their receipts (Albert Heijn). Draft a holding message now, decide where you’ll post it (social media, a sign on the door, a text to regulars), and keep a list of key customers and suppliers. If personal data might be involved, remember that a reportable breach must be reported to the ICO without undue delay and, where feasible, within 72 hours of you becoming aware of it (ICO).
Your going-offline checklist
- List your critical systems and what you’d do without each one.
- Write a short continuity plan and keep a printed copy with key phone numbers.
- Agree who decides to take systems offline, with a named deputy.
- Set up manual fallbacks for tills, card payments and order taking, and show staff how they work.
- Follow 3-2-1 backups with at least one offline or immutable copy, and test a restore.
- Prepare a customer message, and rehearse the plan once a year.
References
- Albert Heijn, “Mediastatement inzake cybersecurity incident”, updated 12 October 2026, 17:20 (in Dutch)
- Ahold Delhaize, “Ahold Delhaize takes precautionary measures following cybersecurity incident”, press release, 12 October 2026
- BleepingComputer, “Retail giant Ahold Delhaize takes systems offline after cyberattack”, Sergiu Gatlan, 12 October 2026
- Warehouse Totaal, “Bijna alle distributiecentra Albert Heijn liggen plat door IT-incident”, 12 October 2026 (in Dutch)
- VRT NWS, “Supermarket chains Albert Heijn and Delhaize hit by IT woes”, 12 October 2026
- Tweakers (via Headliner), “Sites en apps van Albert Heijn blijven offline na ‘securityincident’ van zondag”, 13 October 2026 (in Dutch)
- Grocery Dive, “Ahold Delhaize experiencing cybersecurity issue”, Peyton Bigora, 12 October 2026
- ANP (via ZeelandNet), “Ahold Delhaize nog steeds ‘hard bezig’ met IT-problemen”, 13 October 2026 (in Dutch)
- Hart van Nederland/ANP, “Albert Heijn waarschuwt voor lege schappen komende dagen”, 12 October 2026 (in Dutch)
- BankInfoSecurity, “Supermarket Chain Ahold Delhaize Caught in Cyber Incident”, Tiffany Wang, 12 October 2026
- NOS, “Cyberaanval treft Franse supermarkten, koelsystemen op 50 graden gezet”, 12 October 2026 (in Dutch)
- Computer Weekly, “Co-op shuts off IT systems to contain cyber attack”, Alex Scroxton, 30 April 2025
- National Cyber Security Centre, “Small Business Guide: Response & Recovery – Step 1: Prepare for incidents”
- National Cyber Security Centre, “Offline backups in an online world”, blog post
- National Cyber Security Centre, “Exercise in a Box”
- Information Commissioner’s Office, “72 hours – how to respond to a personal data breach”
Need a hand applying any of this to your business? Get in touch — call +44 1472 564538 or email services@msl.org.uk.