Dutch police publicly urge Ahold Delhaize to report its own cyber breach

Dutch police and the public prosecution service are publicly urging Ahold Delhaize, the parent company of Albert Heijn, to file a crime report over the "cybersecurity incident" that has disrupted its systems since Sunday night. There is currently no criminal investigation — and there cannot be one, because prosecutors cannot open a case until the victim files.

The company has met the obligations the law actually imposes. It notified the National Cyber Security Centre, as required. The police report — the document that would set investigators to work — has not been filed, and Ahold Delhaize has offered no explanation for the gap. On Wednesday the police went public, saying they had been in contact with the company, had "invited" it to report, and noting that "in order to successfully track down and prosecute, it is crucial to always get information from victims as quickly as possible."

The delay is costing money elsewhere. Sector insiders told the Financieele Dagblad, on condition of anonymity, that the crisis is running up tens of millions of euros a day; Ahold says it is too early to quantify. Albert Heijn's fruit and vegetable sections ran thin, its website and app were still taking no orders on Thursday evening, and the incident also knocked out the Etos and Gall & Gall chains, Delhaize's stores in Belgium and Stop & Shop and Food Lion in the United States. The same weekend brought a separate attack on hundreds of supermarkets in France. Police say servers in the US, Poland, Moldova and Turkey were used in the attack, while cautioning that routed traffic says little about where the attackers actually sit. The company says nothing indicates that customer or employee data was involved.

The police statement framed the stakes beyond one retailer: "We can no longer see cybercrime as a collection of separate crimes, but as a criminal ecosystem... Behind almost every attack lies a chain of cooperating perpetrators, resources and criminal services." Mapping that chain begins with a company choosing to hand over what it could equally sit on.

By Thursday evening Albert Heijn's distribution centres were running again and deliveries of non-perishable goods had fully resumed. The report that would let police begin work had still not been filed.