What the Albert Heijn cyber incident teaches food retailers about preparing for disruption

On Sunday 11 October, Albert Heijn, one of the largest supermarket chains in the Netherlands and a subsidiary of Ahold Delhaize, was hit by a cyber incident. As a precaution, the company took parts of its IT system offline. Distribution centres came to a standstill, the website and app went down, and online orders could not be delivered. Within a day, shelves began to empty, especially for fresh produce. Stores were not expected to resume regular replenishment until three days later, and a week later, home delivery still had not fully resumed. The incident shows how vulnerable food retail has become to digital disruption and how important it is to be prepared.

So, what can supply chain managers in food retail learn from this incident? We asked three researchers from RSM’s Technology and Operations Management department – Prof. Niels Agatz, professor of last-mile supply chain analytics; Dr Harwin de Vries, associate professor specialising in humanitarian logistics and supply chain resilience; and Dr Robert Rooderkerk, associate professor of operations management specialising in retail operations – the same question:

Based on your own research, what concrete lesson would you give supply chain managers in food retail to help them prepare for a disruption like the one at Albert Heijn?

Robert Rooderkerk: treat resilience as a core part of retail operations, not as an extra cost.

Grocery retail runs on razor-thin margins. “When consumers spend €100 on groceries, a typical retailer may retain only around €1 in operating profit,” says Rooderkerk. “Operating efficiently is therefore not simply a competitive advantage; it is essential for survival.” The downside became clear when gaps appeared across many product categories within days, despite limited evidence of consumer stockpiling.

In an omnichannel world, retailers increasingly connect their stores and online operations, and link data from loyalty programmes, transactions and inventory systems. According to Rooderkerk, this integration is essential to creating value, but it also means that “disruptions in one part of the organisation can quickly cascade into others.”

“The central challenge is clear,” says Rooderkerk. “How can retailers become more resilient without sacrificing too much of the efficiency on which their business models depend?” He sees several avenues worth considering:

• Leaner assortments that reduce operational complexity.
• IT systems that keep disruptions within one silo, so that a failure in one part of the business doesn't spread to the rest.
• Simple fallback procedures, such as replenishing core products based on historical sales averages when advanced forecasting and ordering systems are down.

Niels Agatz: prepare contingency plans and train people to run operations under different scenarios of IT and data disruption.

Real-time inventory data allows retailers to minimise stock and reduce food waste, Agatz explains. “At the same time, the dependency on IT makes them vulnerable. The system runs on data, and without it the system is blind. Human operators also depend on this data, so they cannot do their work either.” It is like a navigation system: it helps us find our way faster, but without the maps we would struggle to get around.

Holding structurally higher stock is not the answer either: it would raise costs, threaten the affordability of food and create food waste. “The way forward is to create contingency plans and to train people better to run operations under different scenarios of disruption of the IT and data system,” says Agatz. Retailers can, for example:

• Temporarily reduce complexity, for example by focusing on a core subset of the assortment.
• Ramp up the workforce quickly, so staff can take over tasks manually when systems fail.

Harwin de Vries: prepare alternative ways of working – including analogue ones – that you can switch to when your normal way of working breaks down.

When Albert Heijn's systems went offline, its normal way of working broke down almost overnight. For disaster relief organisations, that is a familiar situation: they work in crises, where conditions change quickly and normal procedures often stop working. De Vries has worked with more than 25 humanitarian and health organisations, studying how they make key supply chain decisions. He believes retailers can learn from how these organisations prepare.

“If there is one thing we can learn from disaster relief organisations, it is that you need to prepare different ways of working: alternatives you can switch to when your normal way of working breaks down,” says De Vries. Organisations such as Doctors Without Borders (MSF) have two to five alternative versions of the same process and can quickly switch from one to another when needed. This is called process modularity.

“Developing process modularity is a matter of preparedness: you cannot quickly build it after the crisis hits,” says De Vries. “In particular, we may need to be prepared to temporarily go analogue for critical supply chain processes such as managing the warehouse, checking stock levels, placing orders and planning transport.”

Other measures humanitarian organisations use to prepare, as De Vries described in an earlier RSM Discovery article, include:

• Clear roles and responsibilities for managing a disruption, agreed in advance.
• Scenario-based plans that map what could go wrong and which gaps would arise.
• Agreements with suppliers and partners that can be activated quickly.