Albert Heijn reported a cyberattack under a new cybersecurity law that came into force in August. The incident disrupted the supermarket chain’s website and app, prevented the delivery of some online orders and temporarily shut down several distribution centres, making it harder to supply stores. The company also switched off part of its IT systems after detecting the problem.

The law requires organisations in essential sectors, including supermarkets, to report suspected high-impact cyber incidents to the National Cyber Security Centre within 24 hours and provide an update within 72 hours. The information is also passed to the relevant regulator; for supermarkets, that is the Netherlands Food and Consumer Product Safety Authority. Companies must take appropriate preventive measures, and directors may be held personally liable if serious shortcomings or intent are established.