Albert Heijn cyber incident shows how exposed the Netherlands is

A cyber incident at Albert Heijn left shoppers with empty shelves, wrong prices and missing personal discounts at the till, and the cause is still being investigated. NU.nl Tech reports that Dutch security experts see the disruption as proof that the Netherlands is too vulnerable to digital incidents and that many companies are not ready to keep running when their systems fail.

What happened

Customers saw the effects before anyone could explain them. According to NU.nl, shoppers found empty shelves, some of the products still on sale carried incorrect prices, and people at the checkout did not receive their personal discount. What exactly went wrong is still being looked into.

Dave Maasland, a cybersecurity expert at ESET Nederland, told NU.nl it was in some ways lucky that only one supermarket was hit, because customers could still shop somewhere else. He asked readers to imagine several chains going down at the same time. Kees Verhoeven, an IT expert and former member of the Dutch House of Representatives, called for more cyber resilience. In his view, disruptions like this will become more frequent and society needs to be prepared for them.

Cyber resilience, as NU.nl explains it, goes beyond trying to stop attacks and outages. It also means a company can recover quickly after an incident, which requires a clear plan for what happens in an emergency. Rick van der Kleij, who leads research on cyber-resilient organisations at Avans University of Applied Sciences, said it is clear that Dutch companies are not prepared well enough. He wants businesses to move away from a “just in time” mindset built around efficiency and towards a “just in case” approach that plans for things going wrong. Verhoeven added that physical, offline thinking is slowly disappearing from daily life, even though the risks remain, and that offline backup plans make sense.

The National Cyber Security Centre (NCSC) was more measured. A spokesperson told NU.nl that organisations should know their “crown jewels”, meaning their most important data, products, services and secrets, and should know whether those depend on IT. An analogue fallback is one option, the NCSC said, but it has to be judged as part of wider risk management. The spokesperson also gave an example of its limits: if a supplier works entirely digitally, a company still cannot place a paper order.

The experts do not treat Albert Heijn as a one-off. NU.nl lists three earlier cases: a failure at Maasstad Hospital in Rotterdam earlier this year that stopped operations from going ahead, a hack on systems of the Public Prosecution Service (Openbaar Ministerie) last year that delayed thousands of court cases, and a 2024 outage that hit the computers at Eindhoven Airport and halted all flights for a day. Maasland used a Dutch expression to describe the situation: in many places the key is still hanging on a string behind the letterbox, so anyone can let themselves in. He said the country is now being forced to face the fact that this is no longer acceptable.

Why it matters for internationals in the Netherlands

Start with daily life. The cases NU.nl lists include a supermarket, a hospital, the courts and an airport. These are services that internationals rely on as much as anyone, and when they go down there is often no clear way around them. Maasland’s point about being able to switch to another supermarket only works while the problem stays with one company. For newcomers who have not yet built up local routines or contacts, a wider outage could be harder to handle.

The Albert Heijn case also points to something smaller. Prices on the shelf were sometimes wrong, and personal discounts did not apply at the checkout. When a retailer’s systems are disrupted, it is worth checking your receipt and keeping some flexibility in how and where you shop until things are back to normal.

On data and regulation, NU.nl does not say whether any customer data was affected, so nobody should assume either way. The article does cover the legal background. NIS2, a new European cybersecurity law that came into force last August, sets requirements for the digital resilience of thousands of organisations in the Netherlands. One part of it requires companies to look closely at their partners. Maasland advises organisations to map their most important suppliers so they know where risks could come from, and to keep checking each other for weak spots. Van der Kleij welcomed a change in attitude: companies used to keep cyber incidents quiet, he said, but now they are more open about them, which helps everyone learn. For consumers, that should mean hearing sooner when a service you use has been hit.

For anyone working in Dutch tech, IT or risk management, the article suggests where the work is heading. The experts recommend much more frequent digital fire drills, in which incidents are simulated in a safe environment to show where the weak points in a chain are. The NCSC calls regular checking and testing of backups essential, and notes that these often only get attention once a recovery is actually needed. Combined with NIS2 obligations for thousands of organisations, that points to growing demand for people who can plan, test and run this kind of preparation.

Budgets are still a constraint. Van der Kleij told NU.nl that companies are reluctant to prepare fallback plans and invest in resilience because it costs money and feels like an investment that may never pay off. If you work at an organisation covered by NIS2, expect to see more drills, supplier reviews and backup tests, and possibly some internal argument about who pays for them.

What to watch next

The first thing to watch is the outcome of the Albert Heijn investigation. Once it is clear what failed and how long recovery took, other retailers will have a concrete case to measure themselves against. Maasland has said the incident should be a wake-up call for other organisations, and the coming months will show whether anyone acts on it.

The second is NIS2. The law has been in force since August, and the real test is whether the thousands of Dutch organisations it covers start running fire drills, testing backups and auditing suppliers, or treat it as paperwork. The third is openness. If Van der Kleij is right that companies are becoming more willing to talk about incidents, the public will learn more about what goes wrong and why, and so will the people building the next generation of Dutch digital services. For more coverage of technology in the Netherlands, visit Mylistingo.

Source: NU.nl Tech