Albert Heijn Cyber Incident: Retail Disaster Recovery Lessons

The Store Is Open. Is the Business? What Retail Cyberattacks Teach Us About Minimum Viable Business

For most retailers, the first measure of business continuity is simple: Are the stores open? Can customers buy products? Are payments working?

But recent cyber incidents across Europe reveal a problem with that assumption. A retailer can keep its doors open while losing the systems that replenish inventory, fulfill orders, manage customers, or keep food safe.

The incidents involving Albert Heijn in the Netherlands and several supermarket chains in France are different and have not been linked by authorities. Together with earlier attacks on retailers such as METRO, they raise a bigger question about cyber resilience: What is the minimum a retail business needs to keep operating when its technology is under attack?

That is the question every retailer should answer before its next incident. It is the foundation of a Minimum Viable Business (MVB) strategy.

What Albert Heijn, METRO, and French Supermarkets Have in Common

In October 2026, Albert Heijn, part of Ahold Delhaize, experienced a cybersecurity incident that forced the company to take several systems offline as a precaution.

Its physical stores remained open and checkout systems continued operating. But websites, applications, customer service, online grocery deliveries, and parts of the logistics operation were disrupted. Digital shelf labels and loyalty services were also affected.

According to Albert Heijn’s incident updates, regular store replenishment had resumed by October 15, while online grocery deliveries were canceled through at least October 18.

The stores were open, but significant parts of the business were not operating normally.

In France, retailers including Intermarché, Carrefour, Monoprix, and Coopérative U faced a very different disruption. Attackers compromised connected refrigeration management systems, manipulating temperature and defrost settings. The result was spoiled inventory, damaged equipment, and substantial financial losses.

The affected retailers were dealing with something beyond a conventional IT outage. Their physical ability to store and sell food safely had been compromised.

And this is not the first time retail has faced that distinction. During a cyberattack in October 2022, METRO experienced partial IT failures and introduced offline payment systems to keep stores operating. The company subsequently estimated an earnings impact in the mid-double-digit millions of euros.

Three different incidents, different systems, and different recovery challenges. But they all expose the same weakness in how we measure business continuity.

Keeping a store open does not mean the entire business is operational.

Minimum Viable Business for Retail: What Must Survive?

The lesson from Albert Heijn and the French supermarket attacks is clear: stores can remain open while critical business operations fail. Defining a Minimum Viable Business (MVB) means identifying which functions must survive, what they depend on, and how quickly they need to recover.

For retailers, five areas should be evaluated:

Business function	Critical dependencies	Key recovery question
Checkout & payments	POS, payment gateways, connectivity	Can customers still pay if central systems fail?
Inventory & supply chain	ERP, warehouses, supplier integrations	Can stores replenish stock within 48 hours?
Refrigeration & food safety	Controllers, monitoring, configurations	Can safe operating conditions be restored?
E-commerce & fulfillment	Cloud, order management, delivery services	How long can online operations remain offline?
Identity & connectivity	IAM, DNS, firewalls, network configurations	Can teams access and restore critical systems?

The COO, CIO, and CISO must agree on what cannot stop, what can operate in reduced mode, and what must recover first.

But identifying critical systems is only half the exercise. Retailers must also understand the dependencies behind them and whether those dependencies, including their configurations, can actually be restored.

A Minimum Viable Business is not a list of critical applications. It is a tested plan to keep essential business operations running.

The Missing Layer Behind Retail Disaster Recovery

Most retail disaster recovery strategies are built around identifiable systems: POS, ERP, warehouse management, e-commerce applications, databases, and payment infrastructure.

These systems matter. But the applications and data are only part of what makes them operational.

Behind them sits an extensive layer of configuration. Identity policies determine who can access applications. Network routing and firewall rules connect stores, warehouses, and cloud services. DNS and edge configurations keep digital storefronts accessible. Cloud permissions and SaaS integrations allow systems to communicate.

When a serious incident occurs, these dependencies become part of the recovery problem.

Consider a retailer restoring its online ordering platform. The application and its data might be available, but if the identity configuration, network access policies, or cloud integrations are missing or compromised, the platform may still be unable to operate.

The French refrigeration incident offers another illustration of why configuration matters. In its security advisory, France’s CERT-FR instructed operators to verify equipment configurations, including defrost settings, and to reconfigure compromised systems before returning them to service.

Those are industrial control systems, distinct from the cloud and SaaS environments most enterprise IT teams manage. But the underlying recovery principle is the same.

Restoring a system requires knowing what its correct operating state should be.

That creates a retail recoverability gap: organizations know which business services are critical, but may not have a trusted, recoverable version of every configuration and dependency required to run them.

A Recovered System Is Not a Recovered Business

Most retailers test disaster recovery one system at a time. The database is restored, the application is online, and the infrastructure team reports success. But that doesn’t necessarily mean the business can operate.

Consider a supermarket recovering from a cyberattack. Its warehouse management system may be back online, but can it process new orders, communicate with suppliers, and get products delivered to stores? If any part of that process fails, the business is still disrupted.

This is why recovery testing must go beyond individual applications. Retailers should test complete business processes, measure how long it takes to restore them, and identify where recovery breaks down. A successful test should prove that customers can purchase products, stores can replenish inventory, and critical operations can resume safely.

The real measure of recovery is not how many systems are back online. It is how much of the business is actually running.

Configuration Recovery Is Part of Retail Cyber Resilience

This is where ControlMonkey fits into the broader recovery strategy.

Traditional data protection platforms address an essential part of recovery. But a retailer also needs to recover the cloud, network, identity, and SaaS configurations that connect its critical applications and services.

ControlMonkey focuses on making that configuration layer recoverable.

The platform automatically discovers cloud and supported SaaS configurations, captures versioned snapshots of their operating state, tracks changes and drift, and provides visibility into which resources are protected and which remain exposed.

When configuration must be restored, teams can use previous known-good states to recover supported cloud and SaaS resources without manually reconstructing their settings and dependencies.

For a retailer, this can mean protecting the configuration behind critical digital functions such as online ordering, access management, cloud infrastructure, network connectivity, and security controls.

ControlMonkey does not replace application or data backups, nor does it directly restore industrial refrigeration controllers. It addresses a distinct part of the recovery challenge that conventional backup strategies can leave exposed.

And that distinction matters. A Minimum Viable Business is only recoverable if the infrastructure and configuration supporting its essential services are recoverable too.

The Real Test Is What Happens the Morning After

Retailers invest heavily in preventing attacks and maintaining uptime. But the lesson from Albert Heijn, METRO, and the French supermarkets is that disruption rarely respects the boundaries between individual IT systems.

A cyber incident can affect payments, supply chains, online services, or the physical equipment that protects inventory. The consequences are measured in lost revenue, disrupted customers, operational costs, and the ability to continue trading.

Business leaders need to define what survival looks like before that disruption happens.

Which stores must continue operating? Which services can be temporarily suspended? What dependencies must be restored first? And can the organization prove that the configuration behind those systems is recoverable?

A Minimum Viable Business gives those questions a business answer. A tested recovery strategy gives them an operational answer.

Opening the doors is one thing. Keeping the business behind them running is the real measure of resilience.