Albert Heijn Returns at One-Third as Rivals Take Share

Albert Heijn restarted grocery deliveries on 23 October at about one-third of its usual van capacity. The halt began on Sunday afternoon, 11 October, when Ahold Delhaize shut websites, apps and warehouse systems after finding hostile activity in its network.

The shop app is taking orders again. The first disrupted week already sent a slice of the till to Jumbo, Picnic, Plus and Lidl, and the same weekend showed a second way to stop a supermarket: seize the fridges.

Deliveries Restart at One-Third Capacity

Albert Heijn told customers on 23 October that everyone can place an online order again, after a first group of Bezorgbundel subscribers and business accounts was let back in on 21 October. Vans went out on 23 October. The chain says it has about one third of usual delivery capacity and that slots, including fixed subscription times, should be back to a normal load on Wednesday, 29 October. Belgian vans are due out on 26 October.

Sister shops Gall & Gall and Etos have their sites up. Store replenishment, Albert Heijn said on 21 October, is running on a regular rhythm again for dry goods and fresh food. That is a different machine from home delivery. The warehouses that pick van orders were among the systems taken down, so getting ah.nl live did not put the fleet back at full strength.

THE RESTART IN FIGURES

• Van load: About one-third of normal delivery capacity on 23 October.
• Days offline: 12 days from the 11 October shutdown to the first resumed drops.
• Full slots: 29 October is the date Albert Heijn has set for usual capacity and fixed bundel times.
• Who could order first: Bezorgbundel and business accounts from 21 October; all customers from 23 October.

Frans Muller, president and CEO of Ahold Delhaize, has defended the darkening of the network. The group took certain systems offline as a precaution after the investigation confirmed “the malicious actions of others,” and it says it still has no evidence that sensitive customer, staff or partner data was taken.

Taking systems offline to help protect them was a precautionary measure that affected most of our brands across Europe and the United States. The investigation to date confirms this was the right decision.

Frans Muller, President and CEO, Ahold Delhaize newsroom, 19 October 2026

Nobody has claimed the intrusion. Ahold has not described the malware, a ransom, or a point of entry, and it says further technical detail could hinder the response.

Albert Heijn’s Share Fell From 37% to 28%

The commercial leak happened before the first van rolled. Data firm Hiiper, measuring week 42, found Albert Heijn’s Dutch supermarket share dropped from about 37% to 28%. That is a 9 point fall, about a quarter of the chain’s own usual share, in the first week the systems were dark.

WHERE THE SHOPPERS WENT

Jumbo took the largest bite in absolute terms, a 4 point gain. Plus, Lidl and Vomar also added share. Picnic, the dedicated online grocer, posted the strongest relative sales lift at 20% against its own baseline. Hiiper also found that a part of the missing Albert Heijn spend never arrived at a rival: some households simply delayed the shop, so the whole market was smaller than a normal week, and rival share gains overstate the extra euros they actually rang up.

The mix of winners is the awkward part for anyone who assumed a delivery outage would just move carts to another app. Most of the shift landed in physical stores. Picnic grew, but the bigger transfer went to chains whose doors never closed. Once a household has walked a Jumbo aisle for a week of milk and fruit, a €10 credit on the next ah.nl order is asking them to walk back.

What Failed in Stores That Never Closed?

Ahold’s public line is that stores stayed open. They did. Checkouts took cards. National Bonus leaflet deals still scanned. The shop floor was still a computer, and several of those computers failed in public.

WHAT STOPPED WORKING IN STORE

• Shelf labels: Electronic tags kept last week’s promo prices while the till charged the current one, so the aisle and the receipt disagreed.
• Personal loyalty: The general Bonus card worked; personal discounts, Koopzegels, Air Miles and other app-linked stamps did not.
• Warehouses: Several distribution centres stopped, and Albert Heijn warned that fruit, vegetables and other fresh lines would thin first, with frozen food, bread and longer-life goods lasting longer.
• Service desk: Websites, apps and customer service went dark with the logistics stack, so cancelled orders had no live chat behind them.

By 13 October the chain said regular prices on digital shelf tags were correct again, with Bonus prices still missing on the rail but applied at the till. By 21 October it said tags, including live Bonus prices, matched again. Replenishment, it said the same day, was back to a normal pattern for every product group. The open shop was never a fully analogue fallback. It was a store whose pricing, stamps and stock flow all sit on the same kind of network the group chose to power down.

Stop & Shop Went Dark With Food Lion

The Dutch outage was not a local IT hiccup. Muller’s 19 October update said the precautionary shutdown hit most brands in Europe and the United States, with the pain uneven by banner. Belgium’s e-commerce was already fully up by then. Most Central and Southeastern Europe sites and apps were available. The U.S. brands were not.

Stop & Shop, Food Lion, Hannaford, Giant Food and The Giant Company websites and apps sat on holding pages from 12 October. Pickup and delivery died with them. Stores, pharmacies and fuel forecourts stayed open. The five U.S. sites came back on 20 and 21 October, about 8 days after they went dark. Food Lion president Greg Finchum said customers had been left without “the digital experience our customers expect and deserve.” Stop & Shop president Roger Wheeler apologised for the app and site outage and pointed shoppers to open stores. Food Lion is running free pickup or delivery through 31 October.

Some U.S. shoppers still could not log in after the domains returned, and got in only after a password reset and a fresh install. Staff at Stop & Shop also had trouble reaching schedules and pay stubs while the network was gated. A defensive shutdown that is “right” in Muller’s terms still takes down payroll-adjacent tools and the weekly shop in the same stroke, because those tools share the pipe.

This is Ahold Delhaize’s second serious cyber episode in two years. In November 2024, attackers spent 5 and 6 November inside U.S. business systems. INC Ransom later claimed the job and said it took 6 TB. The company went on to notify 2,242,521 people that employment files holding names, Social Security numbers, bank details and health data had been reached. The 2026 incident, Ahold says, has not produced evidence of a similar theft. The police file is still the live process, not a closed forensic note.

French Freezers Were Turned Into Ovens

Overnight on 11 and 12 October, while Ahold was taking its own stack offline, attackers in France reached internet-facing fridge controllers and forced long defrost cycles. Units were driven as high as 50°C. Stock thawed, then cooked. Several stores reported fires. The Paris prosecutor’s cybercrime section opened a case on food spoilage and those fires.

Dominique Schelcher, CEO of Coopérative U, said 80 of his network’s nearly 2,000 stores were hit. Staff held the cold chain in most of those shops; where they could not, product was pulled and destroyed. Carrefour put its tally at 80 stores. The Dutch National Cyber Security Centre has said it has no reason to treat the Dutch incident as directly linked to the French campaign, or to other food-sector attacks abroad. They remain two jobs on the same weekend, not one plot.

Attacking equipment essential to the conservation of fresh products means attacking the food supply chain of the French people. It is unprecedented, extremely serious, and unacceptable.

Dominique Schelcher, CEO, Coopérative U, on X

France’s CERT-FR alert confirmed compromises of Danfoss AK-SM and AK-SC series controllers, plus Copeland XWEB and Dixell XWEB monitors. Danfoss said many of the boxed units were legacy models that no longer get security updates, or were running old firmware. Two months earlier, Claroty’s Team82 had published flaws in the current AK-SM 800A web interface, including a hidden “code-of-the-day” login (CVE-2025-41450) derived from the device clock, and had counted 2,765 publicly reachable management interfaces on Censys. Danfoss shipped firmware R4.3.1 for that family. Claroty’s bugs have not been proven as the French entry path. They do show how a supermarket fridge cabinet, left on the public internet for remote maintenance, can be driven like a website.

That is the split the weekend leaves in place. Ahold’s problem was corporate IT: ordering, picking, labels, loyalty, U.S. apps. France’s problem was operational kit on a vendor network. A grocery group can lose the website, or it can lose the freezer, and both now sit on a login.

Shoppers Get €10, Then Wait Until Wednesday

Dutch police confirmed on 23 October that a criminal investigation is open, after Ahold filed a report on 19 October. A spokesperson said the company had filed and that police do not comment on live cases. Ahold says it told the NCSC within 24 hours of finding the activity. It still will not name an actor. Shoppers asking how much food was dumped, and whether any of it reached food banks, have not had a figure from the company.

THE FORTNIGHT IN DATES

1. 11 October 2026: Albert Heijn, Etos and Gall & Gall take systems down on Sunday afternoon; websites, apps, service desks and van logistics stop.
2. 12 October 2026: Ahold Delhaize discloses a security issue; U.S. banner sites go dark; several Dutch distribution centres halt; France reports the fridge attacks from the night just ended.
3. 19 October 2026: Ahold files a Dutch police report, says Albert Heijn’s site and app are back, and aims at 23 October for home deliveries.
4. 20-21 October 2026: The five U.S. grocery sites return; Dutch bundel and business customers can order again, still at one-third van capacity.
5. 23 October 2026: Vans resume for a wider book of orders; police confirm the criminal file; full Dutch capacity remains dated 29 October.

Payback is automatic where Albert Heijn can make it so. Anyone whose online order was cancelled between 11 and 22 October gets €10 in shop credit on the next checkout, and a refund if they had already paid. Bezorgbundel holders get a separate €10 credit for the weeks they could not use the pass. Rittendeal customers get an extra run, and runs logged between 12 and 22 October have been put back on the balance. AH Premium shoppers are due a coupon for the missed 10% off Bio and AH Terra lines. Air Miles from the dark week are being written to accounts. For the pan stamp campaign, the chain is sending two full cards as a coupon worth €5 extra off a pan. Koopzegels still need a paper receipt at the store. Business accounts were told a separate plan would follow.

A €10 credit does not reopen a Tuesday 19:00 slot before 29 October, and it does not move Hiiper’s week-42 share back from Jumbo. The police file is open, the attacker is unnamed, and the vans are running at one-third until the date Albert Heijn has put on the calendar.