Since Sunday afternoon, 11 October, Albert Heijn has been dealing with a cybersecurity incident. Albert Heijn is the largest supermarket chain in the Netherlands. Its website and app were offline for a week, online ordering is still not possible at the time of writing, and customer service is still unreachable.

This is not an article meant to scare you. It is an article to do something with. However large or small your business is, the questions this incident raises are the same. Status: Monday 19 October 2026. The investigation is still ongoing.

What we know, and what we do not

This is what Albert Heijn has reported itself in its media statement:

What we do not know is the cause. Albert Heijn says it cannot comment on the investigation, and reports that there are currently no indications that personal data is involved. Dutch broadcaster NOS reports, based on anonymous sources, that this is a hack or a serious attempt at one, and that security staff saw suspicious traffic and therefore shut down systems. That has not been confirmed.

So I am not going to guess how the attackers got in. Nobody outside the investigation knows, and guessing helps no one. The same goes for the technology: whether the Albert Heijn website runs on WordPress is unknown, and it does not matter. A week offline because of an attack can hit any website, on any platform. What I can do is look at what was visible, and what it means for your website.

Lesson 1: taking things offline is a skill

Albert Heijn shut down a number of systems as a precaution to protect its IT environment. What exactly was going on behind the scenes we do not know, but the principle is familiar: anyone who cannot isolate quickly loses time that is not there to lose.

For your website it comes down to a simple question. If you suspect at ten o’clock tonight that something is wrong, who can take the site offline, and does that person know how? Hosting login details, access to the control panel, a maintenance mode that is ready to switch on. They are small things you do not want to be hunting for at that moment.

Lesson 2: know what keeps working

At Albert Heijn the stores stayed open and the tills kept working. The website, the app and the loyalty system dropped out. That distinction was no coincidence, and it determined what customers noticed of the disruption.

How is that at your business? If your website goes down, can customers still reach you, order or pay? For many businesses that depends on exactly one website and one payment plugin. Decide in advance what the minimum is that must keep working, and make sure an alternative exists, even if it is just a phone number and an email address.

Lesson 3: recovery is a sequence, not a button

Recovery at Albert Heijn happened in steps. First the distribution centres, then deliveries to stores, then the website and app, and at the time of writing not yet online ordering. Eight days after it began, a customer still cannot order there.

An organisation of that size cannot be compared to a WordPress website, and I will not pretend otherwise. For one client I measured thirty minutes for a full restore. But that number is only worth something because it was measured. Without a measurement, your recovery time is an assumption, and a backup that has never been restored is not a tested backup.

Also decide which parts must come back first. For a webshop, that is receiving orders, not the blog.

Lesson 4: communicate through channels that are not broken

Albert Heijn’s customer service was unreachable. So communication ran through a central media statement with a timestamp on every update, through social media and through information in the stores. Customers always knew where to look.

Your website cannot announce that your website is down. Do you have a channel that is separate from your own server, such as a social media profile or an email address that does not run on the same hosting, where you can tell customers what is going on?

Lesson 5: phishing follows the news

Albert Heijn warned customers on day three about scammers posing as employees, while saying there are no indications of stolen personal data. Criminals exploit the unrest, even when nothing was taken.

If you have customers, tell them now how you do and do not contact them. That you never ask for a password by email, for example. It is better to do that before an incident than during one.

Lesson 6: customers do not wait

Jumbo, Lidl, Picnic, ALDI and PLUS told Dutch news agency ANP that they saw busier stores and more online orders. That is no surprise. A customer who cannot order goes next door.

Every day your webshop or enquiry form does not work is a day someone else gets the customer. So it is not only a technical problem, but also a revenue problem.

Lesson 7: one outdated component can hit hundreds of stores

In the same days, a group of French supermarkets was also hit, in the night leading up to Monday 12 October. That appears to be separate from Albert Heijn: a spokesperson for Ahold Delhaize told Reuters there is no reason to see a connection. So I am not drawing one either.

What happened in France is instructive, though. According to NOS, hackers got in through outdated software in cooling equipment from a single Danish manufacturer. Hundreds of stores, including Intermarché, E.Leclerc, Netto and Coopérative U, were affected. Some cooling systems started giving off heat instead of cooling, and were set to 50 degrees Celsius. Many stores had to throw away their stock. One shop owner in Alsace put the damage for his store alone at 220,000 euros.

So the attack did not come through the stores themselves, but through outdated software in a supplier’s component. For your website, that is the third-party plugin or theme that has not been updated for months. Do you know which ones those are?

Six questions for this week

  1. Who decides that the site goes offline, and can that person do it tonight?
  2. What is the first thing that must work again: ordering, the contact form, or everything else?
  3. How long does a full recovery take, measured and not estimated? When was it last tested?
  4. Where do you tell customers what is going on when your website itself is gone?
  5. Do your customers know how you do and do not contact them?
  6. Which third-party plugins and themes run on your site, and which have not been updated in months?

If you can answer four or more of them without thinking, you are in good shape. If not, you now know where to start this week. Feel free to get in touch if you want to know where you stand.

Sources