Albert Heijn, the largest supermarket chain in the Netherlands, told customers through its app on Monday that online deliveries will not resume before Thursday at the earliest. The message extends the outage to at least 11 days, caused by what its parent company, Ahold Delhaize, calls a cybersecurity incident. (Reuters, October 19, 2026.)
The outage is wider than one chain’s delivery app. Websites and delivery services at Ahold Delhaize’s Dutch and U.S. chains — including Stop & Shop, Giant Food, Hannaford, and Food Lion — remained offline on Monday, about a week after the incident prompted the company to shut down some of its own IT systems. Physical stores have remained open, but supplies have been strained where distribution channels were also affected. Deliveries at the Belgian Delhaize chain resumed over the weekend.
Ahold Delhaize has shared few details of the incident: investigations are ongoing, and the company says there is no evidence that customer data was stolen. On Friday, it said it was working on a “controlled relaunch” of several systems. That phrase — controlled relaunch — is the real subject for anyone who operates a customer-facing service. When your own outage ends, what has to be true before you turn the service back on?
What “controlled” means in a controlled relaunch
A controlled relaunch is a staged, verified, reversible return to service — not a single moment when everything switches back on. Functions return in a deliberate order, each stage opens only when its checks pass, and every stage carries pre-agreed conditions under which it closes again. The opposite is the uncontrolled relaunch: restore the systems, reopen every channel at once, and discover your remaining problems in public, at full volume, in front of every customer at the same time.
Can you prove the data is clean before the first order?
Before ordering reopens, the data the service runs on — catalog, prices, inventory, customer accounts, orders already in flight — has to be verified against a state you trust. Transactions written during the incident window are reconciled or quarantined, not assumed good. Reopening on unverified data does not end an incident; it converts a systems outage into a correctness outage, in which customers are charged wrong prices, promised stock that does not exist, and shown information that is not theirs — failures that are slower to detect and harder to forgive than downtime.
Whose credentials still work — and whose should not?
A relaunch re-credentials access deliberately. Passwords, keys, and tokens that existed before the incident are rotated or re-issued; service accounts are inventoried; third-party and vendor access is granted again on purpose rather than inherited by default; dormant accounts are disabled rather than left for later. The logic is simple: whatever path an incident used, it authenticated as something. Reopening with pre-incident credentials leaves every one of those doors exactly as it was found.
What reopens first — and what deliberately stays dark?
Staged re-entry orders the return by risk and by need: informational pages before transactions, one region or banner before the whole estate, read-only access before write access. Each stage is a gate, not a schedule — the next stage opens when the current one is demonstrably stable, not when the calendar says so. Keeping some channels dark on purpose is not failure. It is how a relaunch stays small enough to control while the highest-need services come back first.
Does the physical operation match what the system believes?
Digital systems hold a picture of the physical world — stock on shelves, goods in warehouses, deliveries in transit — and a long outage makes that picture stale. Before ordering reopens, the picture is reconciled against reality: counted stock, confirmed distribution flows, allocation rules for scarce items. An operator who reopens ordering against phantom inventory manufactures a second, self-inflicted outage: thousands of accepted orders that cannot be filled, each one a refund, an apology, and a story.
What do customers hear, and in what order?
Communication in a relaunch is sequenced, not improvised. What is known is said early; reopening is announced stage by stage rather than promised whole; the people who answer phones and chats are briefed before each channel reopens, not after customers discover it. Decisions about unfulfilled orders, refunds, and credits are made before the first stage opens, so the answer a customer gets does not depend on which employee they happen to reach. After eleven days offline, the first message matters as much as the first transaction: it either confirms the service is being run carefully, or it confirms the opposite.
Who is watching the reopened channel for fraud?
A reopened channel is a target. The days after a public outage are when stolen credentials get tested, payment fraud gets attempted, and account-takeover traffic arrives dressed as returning customers. A controlled relaunch therefore opens with a heightened fraud watch — lower transaction limits, closer review of anomalies, faster freeze paths — and treats the monitoring team as part of the relaunch crew, not as an audience. Those controls relax on evidence, over days, not on the first quiet morning.
What would make you turn it off again?
Every stage of a controlled relaunch carries rollback criteria written down in advance: the error rates, integrity anomalies, or support volumes that mean close it again — and one named person with the authority to make that call without convening a meeting. This is the criterion that separates a plan from a hope. An operator who cannot state, before reopening, exactly what evidence would close the service again has not finished the relaunch plan; they have only scheduled the announcement.
The short version
A controlled relaunch is seven answers, in order. The data is verified clean. Access is re-credentialed on purpose. Services return in stages, gated on stability rather than dates. The system’s picture of the physical operation is reconciled with reality. Customers and support staff hear it in sequence, with refund decisions already made. The reopened channel is watched for fraud at heightened levels. And the conditions for closing it again are written down before it opens. “Controlled” is not a reassurance word; it is a checklist — and an operator who can produce the checklist is one whose next update customers can believe.
Related reading: what a sector-wide exercise rehearses that a single firm’s failover test cannot — the same discipline, practiced before an outage instead of during one.
Sources: Reuters, “Albert Heijn online deliveries to stay offline until at least Thursday after cyber incident,” October 19, 2026. Company characterizations above — “cybersecurity incident,” “controlled relaunch,” and the statement that there is no evidence customer data was stolen — are Ahold Delhaize’s own, as reported by Reuters.