The plan you hope you never need.
AI-modified image
Hi,
on Sunday 11 October, Albert Heijn switched off almost everything digital it runs to contain a cyber incident. The stores stayed open. Online groceries didn't come back for nearly two weeks.
Most of us design the customer experience for the days when everything works. This one is about the days when it doesn't: what kept working, what broke, and what I'd want written down before it ever happens.
WHAT HAPPENED
On Sunday 11 October, a cybersecurity incident hit Albert Heijn, Etos and Gall & Gall. Ahold Delhaize shut systems down as a precaution, and almost every digital moment went with them: website, app, customer service, online ordering, delivery, the personal Bonus offers, Air Miles and savings stamps. Several distribution centres stopped, and fresh produce ran short in some stores.
The website and app came back the weekend of 17–18 October. Online ordering didn't. Albert Heijn cancelled every order up to 22 October and restarted delivery on the 23rd at about a third of normal capacity, with full deliveries expected this week. Nearly two weeks without online groceries, at a company retail expert Cor Molenaar, puts at about 35% market share.
WHAT KEPT WORKING
The stores stayed open and the tills worked. The printed Bonus offers applied. Balances were preserved because systems went offline before anything was lost. Paid orders were refunded automatically, customers were told to keep their receipts, and Albert Heijn said compensation for missed personal discounts and savings would be as automatic as possible.
Someone thought this through before it happened: nobody has to fill in a form to get back what they're owed.
WHAT DIDN’T
In the first days, electronic shelf labels in several stores still showed last week's promotional prices, so the shelf and the till could disagree. Personal Bonus discounts didn't apply. And Dutch broadcaster WNL reported shoppers switching to Picnic and Jumbo for delivery.
That last line is the expensive one. Online groceries run on a weekly habit and a saved basket. Two weeks is long enough for a customer to download a competitor's app, rebuild the basket there and find that it works. Taking everything offline was the responsible call. It protects customers and their data, and nobody makes it lightly when every hour offline costs revenue. Molenaar put the damage at a few million euros a day. The bigger number may not be visible yet: how many of those customers stay with the app they tried in the meantime.
MY READ
Most companies have an incident plan for their systems: what to switch off, in which order, who calls whom. Far fewer have one for their customers. The runbook says when the app comes back. It rarely says what the customer experiences until then, or after. Georgina named the crisis as one of the moments that matter most in last week's episode. It's also the one that rarely wins a sprint.
If I owned the customer side of that plan, I'd write down two things before I need them. First, how a customer is made whole without asking: refunds, balances, and compensation that happen automatically. Albert Heijn got this part right. Second, the win-back plan for the habit you lose: what the returning customer sees the first time they open the app again.
Neither shows up in an incident drill, because drills test whether the systems come back, not whether the customers do. So I'd add one line to the post-incident review: of the customers who ordered every week before the outage, how many ordered again within a month after. I don't know Albert Heijn's number, and they may never publish it. It's the one I'd want on the table.
Sources: Ahold Delhaize, ICT Magazine, WNL
RECOMMENDATION
Instadocs: AI Gone Wild (Netflix, 27 min). How AI agents built by OpenAI researchers broke out of their test environment and into Hugging Face in July: about 17,000 actions in two days, with the agents hiding their tracks. Watch it for how fast an attack moves when the attacker never sleeps, then ask who in your company would notice.
Talk soon, Luca
