What returned on October 18 — and what remains unavailable

On October 18, 2026, Albert Heijn said ah.nl and the Mijn AH app were available to all customers again. Users can sign in, browse products and recipes, use general promotions and gift cards, and see saved balances. The chain separately said loyalty points and savings were preserved during the shutdown. [1 · Albert Heijn · cybersecurity-incident update · October 18, 2026]

The interface is back, but sales are not fully restored. Customers still cannot place new grocery orders, every delivery through Thursday, October 22 is cancelled, and couriers are due to return gradually from Friday, October 23. The company says prepaid cancelled orders will be refunded automatically within several days. [1 · Albert Heijn · cybersecurity-incident update · October 18, 2026] [4 · NL Times · Albert Heijn restores its website and app · October 18, 2026]

The incident began on October 11 in parent company Ahold Delhaize’s network. The group said it took some systems offline as a precaution; Reuters later documented five days of website and delivery outages, disruption at Albert Heijn distribution centres and continuing operation of physical stores. [1 · Albert Heijn · cybersecurity-incident update · October 18, 2026] [2 · Ahold Delhaize · official cybersecurity-incident update · October 13, 2026] [3 · Reuters · Ahold online services remained offline for a fifth day · October 16, 2026]

Why an open website is not yet a restored store

Online grocery depends on more than a catalogue and login. Behind the storefront are inventory checks, reservation, slot calculation, payment, picking, routing and refunds. In this case, the account area and part of loyalty are back, while ordering and fulfilment remain constrained; that is a phased recovery, not a single switch. [1 · Albert Heijn · cybersecurity-incident update · October 18, 2026] [2 · Ahold Delhaize · official cybersecurity-incident update · October 13, 2026]

For customers, the practical boundary is whether a purchase can be completed. Browsing products and balances restores access to information but not delivery. Cancelling several days of orders shifts demand to stores or competitors and creates additional refund and communication work. [1 · Albert Heijn · cybersecurity-incident update · October 18, 2026] [3 · Reuters · Ahold online services remained offline for a fifth day · October 16, 2026]

The company says it currently has no indication that personal data was involved. That is an important current statement, but the investigation is unfinished and technical details are undisclosed. The sound conclusion is to record feature availability and the company’s position without inferring an attacker, an intrusion method or the definitive absence of data loss. [1 · Albert Heijn · cybersecurity-incident update · October 18, 2026] [2 · Ahold Delhaize · official cybersecurity-incident update · October 13, 2026] [3 · Reuters · Ahold online services remained offline for a fifth day · October 16, 2026]

Expert commentary

The central lesson is that recovery should be measured by the customer outcome, not the number of servers switched on. The website and app open again, yet the shopper cannot obtain the core outcome of grocery ecommerce — a delivered order — until October 23. Incident dashboards should therefore separate time to restore login, catalogue, checkout, payment, picking and last mile instead of showing one “service operational” status. [1 · Albert Heijn · cybersecurity-incident update · October 18, 2026] [4 · NL Times · Albert Heijn restores its website and app · October 18, 2026]

The five-day gap between the storefront’s return and planned delivery restart exposes how tightly digital and physical systems are coupled. A working interface cannot promise a slot while warehouse, inventory or routing systems are still being restarted safely. Phased activation reduces the risk of another failure, but customer messaging must state exactly which actions work. [1 · Albert Heijn · cybersecurity-incident update · October 18, 2026] [2 · Ahold Delhaize · official cybersecurity-incident update · October 13, 2026] [3 · Reuters · Ahold online services remained offline for a fifth day · October 16, 2026]

The retailer’s economic loss extends beyond missed online revenue. Cancelled orders create refunds, support demand and an opening for habitual shoppers to try another service. Observable measures include returning-customer share, repeat orders after October 23, refund speed, loyalty queries and available-slot percentage in the first week. [1 · Albert Heijn · cybersecurity-incident update · October 18, 2026] [3 · Reuters · Ahold online services remained offline for a fifth day · October 16, 2026]

Preserved loyalty balances and automatic refunds matter because shoppers treat a reward account and a paid order as assets. The company’s statement that it has no indication of personal-data involvement remains provisional, however. It should be updated as the investigation advances and kept distinct from the confirmed availability of interfaces. [1 · Albert Heijn · cybersecurity-incident update · October 18, 2026] [2 · Ahold Delhaize · official cybersecurity-incident update · October 13, 2026]

For other omnichannel retailers, the practical lesson is to design independent degraded modes. Catalogue, loyalty, order capture, warehouse and delivery need predefined safe boundaries, fallback procedures and clear messages. Physical stores kept serving customers here, while the online channel and logistics recovered at different speeds. [1 · Albert Heijn · cybersecurity-incident update · October 18, 2026] [2 · Ahold Delhaize · official cybersecurity-incident update · October 13, 2026] [3 · Reuters · Ahold online services remained offline for a fifth day · October 16, 2026]

Recovery success will be visible after fulfilment normalizes, not on the day the app reopens. Signals for the next two weeks are the actual October 23 delivery restart, the return of ordering, slot stability, absence of another shutdown, refund timing and the investigation’s findings. Until then, this is confirmed partial recovery, not closure of the incident. [1 · Albert Heijn · cybersecurity-incident update · October 18, 2026] [2 · Ahold Delhaize · official cybersecurity-incident update · October 13, 2026] [4 · NL Times · Albert Heijn restores its website and app · October 18, 2026]

Sources

  1. Albert Heijn · cybersecurity-incident update · October 18, 2026 — Official recovery timeline: the website and Mijn AH are available again, saved balances remain intact, new online orders are still unavailable, orders through October 22 are cancelled, and delivery is due to restart gradually on October 23. The company says its investigation continues and it currently has no indication that personal data was involved.
  2. Ahold Delhaize · official cybersecurity-incident update · October 13, 2026 — The parent group confirms a cybersecurity issue in its network and the precautionary shutdown of some systems while it assessed and mitigated the incident.
  3. Reuters · Ahold online services remained offline for a fifth day · October 16, 2026 — Independent timeline: websites and delivery at several brands remained unavailable, physical stores stayed open, and Albert Heijn distribution centres were disrupted. Ahold did not describe the event as a hack and limited detail while the investigation continued.
  4. NL Times · Albert Heijn restores its website and app · October 18, 2026 — Independent report on the restored website and app and the plan to restart deliveries on Friday.