Albert Heijn begins restocking as hack traced to foreign servers

Albert Heijn has started restocking its supermarkets and restarting some IT systems, two days after a “cyber incident” took down many of its supply chains.

Parent company Ahold Delhaize said on Tuesday it was carrying out a “controlled restart of certain systems” and had so far found no indication that customer data had been stolen. It has not said which systems are back up.

Sources in the security sector told broadcaster NOS that Albert Heijn had identified suspicious attack traffic on its systems. According to NOS, the chain’s security staff appear to have switched systems off as the traffic came in, preventing the hackers from getting deeper into the network.

Foreign servers
The company knows that several servers were used in the attack, in the US, Poland, Moldova and Turkey, the sources said. The location of a server doesn’t mean that that is where the attacks are coming from, as traffic can be routed through other countries.

Albert Heijn’s investigation also suggests that servers belonging to Ahold Delhaize’s US arm may be involved. “That could mean the hackers broke into those servers and used them to attack Dutch systems,” cybersecurity expert Pim Takkenberg told NOS.

Another expert, Joey Fennis, said hackers were clearly involved, but it was not yet possible to say what, if any, damage it had caused. “It may also be that Albert Heijn detected them in time,” he said.

Albert Heijn said in a written statement that it was taking the incident “very seriously”, but could not go into technical details at this point.

Shop impacts 
Work at some of Albert Heijn’s six distribution centres in the Netherlands stopped completely on Monday, leaving gaps on shelves. The chain now says several centres are operating, and it is laying on extra deliveries.

Albert Heijn says some shelves may stay empty, like fruit, vegetables and other fresh produce. Online ordering and deliveries are still not possible, and customer service is still unreachable. Chemist chain Etos and off-licence chain Gall & Gall are also affected.

Other countries 
Belgian supermarket chain Delhaize, also owned by Ahold Delhaize, reported IT problems on Monday. Albert Heijn’s stores in Belgium are supplied from the Tilburg distribution centre, and the chain told broadcaster VRT the impact there was limited.

The incident came on the same weekend as a separate cyberattack on hundreds of supermarkets in France. There, hackers remotely forced refrigeration systems to defrost, and chains including Intermarché and Coopérative U had to throw away fresh and frozen food.

An Ahold Delhaize spokesperson told news agency Reuters there was no evidence of a link between the two attacks.