Europe’s Grocers Under Cyber Siege: Albert Heijn Goes Dark While French Fridges Cook
Two European grocery cyber incidents landed within days of each other and both emptied fresh-food shelves — but by different mechanisms. (1) Albert Heijn, the biggest Dutch chain (Ahold Delhaize), was hit by a "cybersecurity incident" starting Sunday 11 October 2026: it switched off its websites, apps, customer service and logistics systems as a precaution, halting online grocery deliveries, and work stopped at some of its six Dutch distribution centres; CEO Margaret Versteden-van Duijn warned shelves would empty, fresh produce (fruit and vegetables) first. Physical stores stayed open and checkouts worked, but electronic shelf labels still showed last week's prices. Ahold Delhaize has NOT confirmed a cyberattack or whether data was affected — outside experts call a cyberattack "very likely" — and reporting indicates Belgian sister chain Delhaize was also affected. This is an IT / logistics-systems incident, not confirmed as OT. (2) Separately, in France, attackers hijacked internet-exposed Danfoss AK-SM/AK-SC refrigeration controllers across hundreds of supermarkets and forced defrost cycles toward 50°C — OT sabotage of the cold chain itself. The two share a lesson: modern grocery runs on just-in-time logistics and cyber-physical cold chains, so an IT outage OR an OT compromise empties the shelves within hours, fresh food first. Food retail is critical infrastructure — in the EU it falls under NIS2 — and resilience means segmenting and hardening both IT and OT, keeping offline/manual fallbacks, rehearsing supplier and store comms, and planning for "we lost the systems that move and chill the food." Cause and scope of the Albert Heijn incident remain unconfirmed at the time of writing; verify against the company and national-CERT statements before acting.
Within a few days in October 2026, two of Europe’s biggest grocers were hit by cyber incidents that looked nothing alike under the hood — and ended exactly the same way: empty shelves, fresh food first. In the Netherlands, Albert Heijn went dark online and stalled its distribution centres. In France, attackers cooked the fridges. One is an IT/logistics failure; the other is OT sabotage. Together they make one point impossible to ignore: food retail is critical infrastructure.
Defensive write-up for security leaders and retail/operations teams. Grounded in public reporting; the Albert Heijn cause and scope are not officially confirmed — verify against the company and national-CERT statements before acting.
Incident 1 — Albert Heijn: the systems that move the food went offline
Starting Sunday 11 October 2026, Albert Heijn — the largest Dutch supermarket chain, part of Ahold Delhaize — was hit by what the company calls a “cybersecurity incident.” What is reported:
- Online shut down. Websites, apps and customer service went offline and logistics systems were switched off, halting online grocery deliveries with no restoration date.
- Distribution centres stalled. CEO Margaret Versteden-van Duijn told NOS that work stopped completely in some distribution centres after systems were taken offline as a precaution. The chain runs six Dutch DCs.
- Fresh food first. The company said fruit and vegetables would be hardest to find; the CEO warned “shelves will empty if this goes on longer.” Stores stayed open and checkouts worked — but electronic shelf labels still showed last week’s prices.
- Cause unconfirmed. Ahold Delhaize has not confirmed a cyberattack or whether data was affected; outside experts call an attack “very likely,” and reporting indicates Belgian sister chain Delhaize was also affected.
Note what did not happen: nobody needed to touch a refrigeration controller. Taking the IT and logistics brain offline — whether by the attacker or by a precautionary shutdown — was enough to stop food moving.
Incident 2 — France: the fridges themselves were the target
Days earlier, attackers hijacked internet-exposed Danfoss AK-SM/AK-SC refrigeration controllers across hundreds of French supermarkets and forced defrost cycles toward 50°C, spoiling food. That one is OT sabotage — the control system for the cold chain was manipulated directly. We broke it down here: When the fridges go dark: your refrigeration is OT.
Two failure modes, one empty shelf
These are the two ways cyber empties a supermarket, and defenders need to plan for both:
- IT / logistics compromise (Albert Heijn pattern): ransomware or an intrusion forces ordering, warehouse-management and distribution systems offline. Just-in-time replenishment stops; perishables vanish first because they can’t be stockpiled. The fix space is classic enterprise resilience — backups, segmentation, EDR, rehearsed recovery, and manual/offline fallbacks for stores and suppliers.
- OT sabotage (Danfoss pattern): the attacker manipulates the cyber-physical system that chills the food. The fix space is OT security — get controllers off the internet, segment them from store IT and point-of-sale, change defaults, and monitor for setpoint/defrost tampering.
Most retailers invest in the first and ignore the second. This fortnight showed both bite, and both end at the same empty fruit-and-veg aisle.
The leadership takeaway
Grocery is critical infrastructure: a chain that cannot move or chill food is a public-resilience problem, not just a quarterly-earnings one. In the EU it now falls under NIS2, which raises cyber-resilience and incident-reporting duties. Practically, that means treating IT and OT as one resilience problem: segment and harden both, keep offline/manual fallbacks for stores and distribution, pre-write supplier and customer comms, and rehearse the scenario “we lost the systems that move and chill the food” before you have to live it.
Pressure-test your own exposure — free, in your browser
- Cold-Chain & OT Downtime Loss Calculator — put a number on a delivery/cold outage.
- Cold-Chain Incident War Room — rehearse the decisions before you make them for real.
- OT Internet-Exposure Analyzer — find controllers reachable from the internet.
- OT Compliance Mapper — see where you stand against IEC 62443 and NIS2.
- War Room incident simulator — drill the IT-side ransomware decisions (isolate vs image, when to disclose, who to call).
As of October 13, 2026. The Albert Heijn / Ahold Delhaize incident is confirmed by public reporting, but its cause and full scope are not officially confirmed and may change; the French Danfoss refrigeration attack is covered separately. Confirm against the companies’ and national-CERT statements before acting, and assess only systems you are authorized to manage.
Ready to practise the decisions these articles describe?
Run a free War Room →