Albert Heijn Hack Fuels Debate: Must You Report It to Police?
After the cyberattack on Albert Heijn, police asked the company to file a report. Why many firms still do not, and what helps preserve evidence.
After the cyberattack on Albert Heijn and parent company Ahold Delhaize on Sunday evening 11 October 2026, police report cyberattack has become the focus of an important debate. The cybersecurity incident caused sites and apps to go offline. By 14 October, Ahold Delhaize had still not filed a report, even though the police and the Public Prosecution Service had explicitly called for one.
The news in brief
- Ahold Delhaize had not filed a report by 14 October after the cybersecurity incident on 11 October.
- The police and Public Prosecution Service want information quickly, because digital traces can disappear fast.
- The NCSC advises companies to report cyberattacks.
What exactly happened?
Ahold Delhaize reported a cybersecurity incident on Sunday evening 11 October 2026. As a result, Albert Heijn sites and apps went offline. By 14 October, the company still had not filed a report with the police.
That raises questions. The police and Public Prosecution Service are explicitly calling on Ahold Delhaize to file a report. The Public Prosecution Service says: “To investigate and prosecute successfully, it is crucial to get information from victims as quickly as possible.”
Cybersecurity expert Pim Takkenberg explains why speed matters. He says: “The longer you wait, the more potential live traces can disappear.” In cyber incidents, this is known as the golden hour: the first few hours are crucial because digital traces can be removed quickly.
For companies, however, filing a report is not always obvious. Cyber adviser Inge Bryan points out that many companies see reporting to the police as a hurdle to their own recovery. “If you bring in the police, you are busy doing everything you can to save as much as possible and get back up and running. The police have a different interest: catching the criminals.”
A criminal investigation can also start without a report from the victim, but a report speeds up the process because the police then receive information more quickly.
Why does this matter to you?
If you work for a company hit by a cyberattack, you will notice it straight away. Logging in may not work, systems may be unavailable, or apps may go down. Your employer then has to make quick decisions: restore systems first so you can get back to work sooner, or call the police straight away to secure evidence.
The same risk applies to entrepreneurs and self-employed professionals. Failures at major suppliers can directly affect your work or business. According to the NCSC, reporting to the police helps with pattern recognition and security updates. It is also important for your insurance claim.
The CBS 2022 monitor shows that many small businesses do not report incidents. Yet fast information is exactly what is needed to help track down and prosecute cybercriminals more effectively.
The current situation: the Netherlands and Belgium
Albert Heijn stores have partly restarted systems since 14 October. Distribution is running again. Online services such as the app, website and customer service were still only partly available on 15 October. Ahold Delhaize says so far no customer data has been stolen.
This debate about filing a report applies to entrepreneurs and workers in the Netherlands and Belgium. Anyone affected by cyberattacks on major suppliers feels the impact directly. Quick reporting can help prevent future attacks.
What does the golden hour mean?
The first hours after a cyberattack are crucial. Digital traces can disappear quickly, so fast police action increases the chance of success. For your employer, that means: the sooner you involve the police, the better you can secure evidence.
What this means for you
If you are an employee: Your employer has to choose quickly between restoring systems at once (so you can get back online sooner) or calling the police immediately (so evidence is better protected). Both choices have consequences for you.
If you are an entrepreneur or self-employed professional: Filing a report helps your insurer and the police, but it takes time. This dilemma is also playing out now at Ahold Delhaize.
More information
Want to avoid your organisation having to make crisis decisions only when it is already under pressure? Read also how to set up an effective cyber policy.
Was this article helpful?
