Albert Heijn hack tests the new Dutch Cybersecurity Act

A cyberattack on Albert Heijn knocked out the supermarket chain’s website and app, stopped online grocery deliveries and halted several distribution centres. According to NOS, it is one of the first major incidents since the Netherlands’ new Cybersecurity Act (Cyberbeveiligingswet) took effect in August, which meant Albert Heijn was legally required to report it.

What happened

NOS reports that when Albert Heijn discovered something was wrong, the company shut down part of its IT systems. The website and app went offline, and groceries ordered online could not be delivered. Albert Heijn chief executive Margaret Versteden-van Duijn said on Monday that a number of distribution centres had stopped completely, which made it harder to restock Albert Heijn supermarkets for a while.

The attack came after the Cybersecurity Act came into force in August. NOS says the law covers thousands of organisations that matter to the Netherlands, including government bodies and companies in healthcare, drinking water, banking and the food sector, which includes supermarkets. Bart Scholten of the advisory and inspection firm Kiwa told NOS that these are the sectors the country needs to keep running at all times, and that they must register with the National Cyber Security Centre (NCSC).

Under the law, organisations must report a cyber incident with significant impact within 24 hours, and also report a suspected one. NOS gives examples of what counts: heavy financial damage, or a serious disruption to services like the one at Albert Heijn. Companies then have to send the NCSC an update after 72 hours. Joke Bodewits of the law firm Hogan Lovells Cadwalader told NOS that a lot happens at once during an incident, and early assumptions often turn out to be wrong later.

Reports to the NCSC are passed on to the regulators who check compliance with the law. For supermarkets, that regulator is the Netherlands Food and Consumer Product Safety Authority (NVWA). If a regulator believes a company’s security was inadequate, it can impose penalties, and directors can be held personally liable. Bodewits said this would probably apply only in cases of serious culpability or intent.

Why it matters for internationals in the Netherlands

The apps and services you rely on

Many internationals depend on grocery delivery apps, especially in their first months in the country, when they have no car or are still getting to know their neighbourhood. The Albert Heijn incident shows how quickly one of those services can disappear. The app and website stopped working, deliveries were cancelled and, according to the company’s chief executive, the shops themselves were harder to supply for a time. A delivery app is only the front end of a much larger system, and when the systems behind it are hit, the effects can reach the physical shop shelves.

The new law does not stop attacks from happening. What it does, according to NOS, is require organisations in essential sectors such as banks, healthcare providers, drinking water companies and supermarkets to take “appropriate” measures, report serious incidents quickly and face oversight from a regulator. For residents, that means the services that keep daily life going in the Netherlands are now under a shared set of rules, rather than each sector following its own.

Data and oversight under Dutch rules

The NOS report does not say whether any personal data was affected in the Albert Heijn attack, and readers should not assume either way. The law it describes is about cybersecurity and keeping services running. It requires organisations to register with the NCSC, report incidents within tight deadlines and work under the supervision of a sector regulator. Bodewits told NOS that reporting also gives affected companies access to the NCSC’s knowledge and expertise, including help interpreting the signs that they have been hit.

Careers in Dutch tech and security

The workplace effects are where the story has the clearest consequences. Scholten told NOS that the law makes cybersecurity a topic for the highest level of an organisation. Companies can no longer treat it as the job of the security or IT department alone. It has to be discussed in the boardroom, with the aim of making the Netherlands digitally more resilient.

The obligations also reach beyond the roughly 8,000 companies Scholten said fall under the law. Many smaller businesses, including suppliers to large companies, are not covered directly. Organisations that are covered, however, must map the risks posed by the businesses they work with, and they can set cybersecurity requirements for those partners. For internationals working at a Dutch startup or small firm that supplies a bank, hospital, utility or retailer, this could mean more security questions from clients and more contractual requirements.

For anyone working in IT, security, compliance or risk, the source describes a market in which incident response plans, supplier risk assessments and reporting within 24 hours are legal duties, not just good practice. Scholten said that what counts as appropriate depends on the situation, but organisations must try to prevent attacks and also have a plan ready for when one happens anyway.

What to watch next

The first thing to watch is how the regulators act. Albert Heijn’s report goes to the NCSC and then to the NVWA, and this case is likely to show how the new oversight works in practice for one of the country’s best-known consumer brands. Whether the NVWA concludes that the company’s measures were appropriate will be an early signal of how strictly the law is enforced.

The second is the question of personal liability. NOS reports that directors can be held personally responsible, although Bodewits expects this only in serious or deliberate cases. How regulators interpret that standard will shape how seriously boards across the Dutch economy take their new duties.

The third is the supply chain effect. Because covered organisations must assess and set requirements for their business partners, smaller suppliers that are not directly covered may still feel pressure to raise their security standards. For internationals building or working at Dutch tech companies, that pressure is likely to show up in client contracts and in hiring for security and compliance roles.

For consumers, the practical lesson from the Albert Heijn incident is simple: digital services that feel permanent can go offline without warning, and the new law is meant to make sure that when they do, the authorities hear about it quickly and someone is held accountable.

Source: NOS Tech