A mysterious cybersecurity incident caused deliveries to shops and customers of Dutch retailer Albert Heijn to grind to a halt last week, highlighting a weakness in the company's drive to digitalise.
On Sunday last week, Albert Heijn's parent company, Ahold Delhaize, decided to shut down its entire digital infrastructure. Ahold has remained vague about what led to the drastic measure, pointing to threats from multiple countries and extreme caution in restarting its IT infrastructure.
According to the Dutch public broadcaster NOS, Ahold detected unidentified traffic on its servers originating from servers located in the United States, Poland, Moldova and Turkey, prompting it to shut down its systems as a preventative measure. NOS reported that the unidentified traffic constituted a hack, with Ahold fearing the attack could penetrate its systems further.
"All the systems went down; no shops were being supplied from the distribution centres," Daan Heijnk, editor-in-chief of Distrifood (a Dutch news platform covering the retail and supermarket economy in the Netherlands), told The Brussels Times. "That’s when chaos broke out."
On the day deliveries
On Monday, shops in the Netherlands were facing empty shelves. Albert Heijn's distribution centres had plenty of stock, but no way of figuring out where to send it to.
In recent years, Albert Heijn invested heavily in making its supply chain as efficient as possible – heavily relying on its digital infrastructure to optimise its systems.
"The shops don’t hold any stock; it’s all delivered on the day," Heijnk explained. "That’s also a pitfall in the system: digital efficiency is brilliant when it works, but if anything goes wrong, all hell breaks loose."
In Belgium, Albert Heijn and Delhaize shops were able to switch to an alternative supply system, only facing limited shortages. "We usually operate under a tight delivery schedule," spokesperson for Albert Heijn Belgium, Ann Maes, told the Brussels Times.
"We were able to keep our stores stocked, albeit on a lower level. In rare instances, certain products were no longer available in certain stores. But customers will have barely noticed anything," she said.
Green peppers
Distrifood visited stores across the country as they scrambled to refill their shelves.
Distribution centres and home depots started supplying stores without knowing what they should send out, which led to bizarre situations.
"For example, you’d see shelves full of bananas, but no other fruit or vegetables at all," Heijnk said. "Or they’d only supply red peppers, and no other colours. They simply supplied things at random, with no sense of organisation."
Stores in Belgium are usually supplied by the distribution centre in Tilburg, a Dutch city. Because the shutdown hit the Tilburg centre hard, it brought stock in from other centres in the Netherlands.
"In retail, you have to be willing to fight, to go with whatever is thrown at you. And I think we proved we can do that throughout the week," Maes said.
A louse in a house
The exact fallout of the attempted hack remains unclear. Ahold claims that no confidential information or customer data was compromised, but is still actively investigating the extent of the hack.
The day after the shutdown, Ahold Europe's CEO Margaret Versteden-van Duijn made a rare public appearance. She denied rumours circulating about a potential hostage situation, where hackers had infiltrated Ahold's servers and accessed sensitive data, demanding payment to return this information.
She did confirm that she had been aware of the situation ahead of Sunday's shutdown. "We’re looking for traces the size of a louse in a house," she said on Dutch television talkshow Eva. "And we have to search every room."
"I feel that supermarkets are actually quite vulnerable," Heijnk said. "Especially when you consider that Albert Heijn is really leading the way in the digital sphere. They’re known for recruiting the best people, and their systems are the most advanced, so I’d assume they’re absolutely top-notch when it comes to security."
"Other retailers, in the Netherlands as well as in Belgium and across Europe, will not be on a par with Albert Heijn," he said. "So if Albert Heijn is vulnerable, then this certainly applies to other retailers, and to an even greater extent."
