Albert Heijn owner files police report over cyberattack

Ahold Delhaize, the parent company of Dutch supermarket chain Albert Heijn, filed a police report on Monday over the cyberattack that forced it to take systems offline more than a week ago.

The company said in a statement on Monday that its investigation had confirmed the suspicious activity in its IT systems was caused by “the malicious actions of others”. Until now it had described the problem only as a “cybersecurity incident”.

Police and the public prosecution service (OM) urged the company to file a report last week, because a criminal investigation cannot start without one.

It is not clear why Ahold Delhaize has now decided to do so, broadcaster NOS reported.

The company did notify the National Cyber Security Centre (NCSC), the justice ministry’s cybersecurity agency, within 24 hours of discovering the attack, as required under a new cybersecurity law that came into force on August 15.

Albert Heijn’s website and app are back online and home deliveries are expected to resume on Friday, October 23, the company said. The websites of drugstore chain Etos and drinks chain Gall & Gall, also owned by Ahold Delhaize, are available again.

Ahold Delhaize said it had so far found no evidence that sensitive data belonging to customers, staff or business partners had been taken. It declined to give further details while the investigation continues, saying they could compromise its security.

The Albert Heijn hack is one of the first major incidents since the new reporting law came into force. It covers some 8,000 organisations seen as vital to the country, from healthcare, drinking water and banks to the food sector, including supermarkets.

The problems began on Sunday, October 11, when Albert Heijn switched off part of its IT systems, halting home deliveries and work at its distribution centres and leaving empty shelves in some stores.

Security sources told NOS last week that servers in the US, Poland, Moldova and Turkey had been used in the attack. Sector insiders told the Financieele Dagblad that the outage was costing the company “tens of millions” of euros a day.