Dutch police and the Public Prosecutors Office have asked Ahold Delhaize to file a police report over a cybersecurity incident that began on Sunday night. “There is currently no criminal investigation into the incident,” the police said in a press release, adding that “Police and the OM have been in contact with Ahold Delhaize. The company has been invited to file a report.”
A criminal investigation cannot be opened without a formal police report, the statement said. Ahold Delhaize did notify the National Cyber Security Centre, as required by law. The company said it will “work with all relevant authorities” but gave no explanation for the absence of a formal police report and said it is not currently making any further statements.
Ahold Delhaize response and operational impact
The incident forced Ahold Delhaize to shut down several IT systems, affecting chains including Albert Heijn, Etos and Gall & Gall and making online shopping and deliveries impossible. Ahold said its distribution centres are running again, but its website and delivery services remain non-operational, preventing customers from placing orders online or via the app.
Deliveries of fresh products were reported to be resuming as of Thursday night, while delivery of non-perishable products has been fully restored. Fresh produce was particularly hard hit, with supermarket fruit and vegetable sections described as very low on stock. Ahold said “the investigation into the nature and cause of the cybersecurity incident is ongoing” and that “At this time, there is no indication that any customer or employee data has been involved in the incident.”
Sector insiders told a Dutch financial newspaper, on condition of anonymity, that the crisis is costing Ahold Delhaize “tens of millions” of euros a day. Ahold told the paper it was too early to say what the financial impact would be.
Police view and attack routing
The police statement warned: “We can no longer see cybercrime as a collection of separate crimes, but as a criminal ecosystem.” It added: “Behind almost every attack lies a chain of cooperating perpetrators, resources and criminal services that reinforce each other: a criminal supply chain.”
Investigators have identified several foreign servers used in the attack, including in the US, Poland, Moldova and Turkey, but said that does not necessarily indicate where the attacks originated because traffic can be routed through other countries. Ahold supermarkets in Belgium (Delhaize) and in the US (Stop & Shop and Food Lion) have also been affected. The Albert Heijn incident occurred on the same weekend as a separate cyberattack on hundreds of supermarkets in France.
The investigation into the cybersecurity incident is ongoing.
