Police urge Ahold to file a report over cybersecurity breach

Dutch police and the Public Prosecutors Office have asked Ahold Delhaize, the parent company of Albert Heijn, to file a report on what the company is still calling a “cybersecurity incident”.

“There is currently no criminal investigation into the incident,” the police said in a press release issued on Wednesday. “Police and the OM have been in contact with Ahold Delhaize. The company has been invited to file a report.”

“In order to successfully track down and prosecute, it is crucial to always get information from victims as quickly as possible.”

Although Ahold did report the incident, which began on Sunday night, to the National Cyber Security Centre as required by law, a criminal investigation can’t be started without a formal police report.

The company says it will “work with all relevant authorities”, but it gave no explanation as to why it hasn’t filed a report and said it is not currently making any further statements.

The incident hit other Ahold chains Etos and Gall & Gall, leading the company to shut down several of its IT systems that has continued to make online shopping and deliveries impossible.

Sector insiders told the Financieele Dagblad, on condition of anonymity, that the crisis is costing Ahold Delhaize “tens of millions” of euros a day. Ahold told the paper it was too early to say what the financial impact would be.

Fresh produce took a particularly hard hit, with the supermarkets’ fruit and vegetable sections very low on stock.

Albert Heijn said on Thursday that its distribution centres are running again, but its website and delivery services are still not operating, meaning customers still can’t place orders online or via app. Deliveries of fresh products were also said to be resuming as of Thursday night, while delivery of non-perishable products has been fully restored.

“This is a positive step forward in the recovery of our supply chain,” said the company. “The investigation into the nature and cause of the cybersecurity incident is ongoing. At this time, there is no indication that any customer or employee data has been involved in the incident.”

Bad actors

“We can no longer see cybercrime as a collection of separate crimes, but as a criminal ecosystem,” said a police statement. “Behind almost every attack lies a chain of cooperating perpetrators, resources and criminal services that reinforce each other: a criminal supply chain.”

Several foreign servers are known to be used in the attack, including in the US, Poland, Moldova and Turkey, but that doesn’t necessarily mean that’s where the attacks are coming from as traffic can be routed through other countries.

Ahold supermarkets in Belgium (Delhaize) and the US (Stop & Shop and Food Lion) have also been affected.

The Albert Heijn incident came on the same weekend as a separate cyberattack on hundreds of supermarkets in France.