Empty shelves in Amsterdam: what the Albert Heijn incident teaches every operator about readiness

Part of our team lives in Amsterdam, and last week the grocery run looked different. The produce section at the local Albert Heijn had gaps where the fruit and vegetables should be. Dairy was thin. Online ordering was gone.

None of it was caused by a harvest, a strike or a storm. A notice taped to the empty shelves explained: "Due to a cybersecurity incident, some products in our store are less available. We are working hard to fully restore our delivery capacity. Thank you for your understanding." (our translation from the Dutch).

We want to be careful here. Albert Heijn has not said what happened inside its systems, the investigation is ongoing, and we are not going to guess. What we can do is look at what has been publicly reported and ask what any operator should take from it, because the same questions apply to a hospital, a utility, a manufacturer or a bank.

What we know

On Sunday afternoon, October 11, Albert Heijn shut down a number of systems as a precaution. By Monday, work at several of its Dutch distribution centers had stopped completely. CEO Margaret Versteden-van Duijn told NOS that this was "because we had to switch the systems off preventively" (our translation).

The effects reached well past the warehouse. NOS reported that shelf labels showed the previous week's promotions, personal Bonuskaart discounts stopped working, and delivery drivers were logged out of their planning app. Sister brands Etos and Gall & Gall were also affected, according to DutchNews. Online orders were cancelled through Thursday.

By Wednesday, shelf-stable deliveries had resumed and the distribution centers were coming back online. On Sunday, October 18, a week after it began, Albert Heijn said shelves were stocked again and shelf prices correct, and its website and app were back. Home delivery resumes gradually from Friday, October 23. The company says it has no indications so far that personal data was involved, and it has not disclosed the cause. Retail experts quoted by ANP estimate losses of around €10 million or more. That is an outside estimate, not a company figure.

Lesson 1: the hardest call was a business call, not a technical one

Turning off the systems that run your supply chain is a decision with a price tag either way. Leave them running and you risk an attacker going deeper. Shut them down and you empty the shelves yourself.

That decision does not belong to the security team alone. It needs operations, logistics, finance, legal and communications in the room, with a clear sense of who has the authority to pull the plug and what runs on manual once they do.

The question for your organization: has your leadership team ever practiced that decision? Not read about it in a policy document, but actually made it, under time pressure, with incomplete information?

Lesson 2: the blast radius lives in your dependencies

If you had asked most people last week what a security incident at a supermarket would break, they would have said the website. Few would have listed shelf labels, loyalty discounts and a driver scheduling app.

This is where incident response plans quietly fall behind. They are written once, then the business changes around them: new systems, new suppliers, new apps, acquisitions. Nobody notices the plan no longer matches the business until the day it is needed.

The fix is not a longer plan. It is exercising the plan against the business as it is today, so the gaps show up in a conference room instead of in the produce aisle.

Lesson 3: how fast you see it shapes what it costs

NOS, citing unnamed security sources, reported that Albert Heijn's security staff identified suspicious traffic and shut systems down as it arrived, which may have stopped intruders from going further. That is unconfirmed, but the general principle holds: the earlier you see something, the more choices you still have.

That is the case for proactive threat hunting. Instead of waiting for an alert, you go looking for the early signs across your environment, and you work through the alerts you do get quickly enough that the real ones are not buried under the noise.

Where ChaosTrack fits

We build for exactly these two moments: the decision under pressure, and the time it takes to see the problem.

ChaosTrack Prepare runs AI tabletop exercises built from your own organization: your systems, your locations, your incident response plans and runbooks. You could run a scenario tomorrow in which your distribution centers go dark on a Sunday afternoon, then put operations, logistics, comms and legal through the shutdown decision together. The exercise is scored against your own runbooks, not a generic checklist, and it produces an updated plan from the run. It is ready in minutes, not weeks, so you can run it again next quarter and ask the only question that matters: did we do better than last time?

ChaosTrack Hunt and Respond works the other side. Hunt lets your team ask plain-language questions across your security tools and shows its plan before it runs. Respond enriches and triages incoming alerts, separates real threats from false positives, and opens an investigation for your team to approve. How much it is allowed to act on its own is a setting you control.

Neither one makes an incident impossible. Nothing does. What they change is how ready you are when it comes.

Five questions to ask your team this week

1. If we had to shut down our core systems as a precaution, who makes that call, and how fast?
2. Which business processes would stop, and which ones could we run by hand?
3. When did we last test our incident response plan against how the business actually runs today?
4. Who talks to customers, staff and regulators in the first hour, and what do they say?
5. How quickly would we spot an intruder who was already inside?

If any of those answers is "we're not sure", that is your next tabletop.