The Statement Named No Cause. It Was Still Inside Information.

At 08:29 on Monday morning, Ahold Delhaize told the market it was experiencing a security issue within its network. The announcement named no cause, no attacker and no finding about data, because the company had none to give. It carried a cautionary notice recording that it contains information qualifying as inside information within the meaning of Article 7(1) of the EU Market Abuse Regulation all the same. That is not thin disclosure. For a listed consumer business with its apps and websites already dark in front of customers, it is close to the only disclosure the rules permit.

Most briefings of this kind turn on a vulnerability. This one has none to discuss, and that is why it is worth a board's time. Strip out everything nobody has confirmed, and what remains is a clean study of the question every listed business eventually faces and few have answered in advance: what do you tell the market when the honest answer is that you do not yet know?

What happened

On Sunday afternoon, 11 October 2026, Albert Heijn, Etos and Gall & Gall began dealing with what Albert Heijn's media statement calls an IT incident. The company says it took immediate measures to protect its IT environment, and that those measures included preventively switching off a number of systems.

The consequences were visible to customers within hours. Websites, apps and customer service went offline. Logistics systems were switched off, so online grocery orders could not be delivered until further notice. Stores stayed open, the tills worked and this week's national Bonus offers from the printed leaflet still applied. One line in Albert Heijn's statement rewards a second reading: last week's promotional prices were still showing on the electronic shelf labels, so for those promotions a lower price might appear on the label than the price charged at the till. Customers who lose personal discounts are to be compensated once that is possible, and are asked to keep their receipts.

• Sunday 11 October 2026, afternoonAlbert Heijn says that it, Etos and Gall & Gall begin dealing with an IT incident, and that immediate measures are taken to protect the IT environment, including preventively switching off a number of systems.
• Monday 12 October 2026, 07:24 Europe/AmsterdamAlbert Heijn publishes its customer media statement. Websites, apps and customer service are unavailable. Logistics systems are off and online orders cannot be delivered until further notice. Stores are open and till systems work. Savings schemes tied to the Mijn AH app and the personal Bonuskaart are down, and affected customers are promised compensation.
• Monday 12 October 2026, 08:29 Europe/AmsterdamKoninklijke Ahold Delhaize N.V. publishes its group statement from Zaandam. It says the company is experiencing a security issue within its network, that teams are assessing and mitigating it, that this includes taking some systems offline to help protect them, and that stores are open and serving customers. The cautionary notice records that the communication contains information qualifying as inside information within the meaning of Article 7(1) of the EU Market Abuse Regulation.
• Monday 12 October 2026, market closeNL Times reports the shares closing at 31.38 euros on Euronext Amsterdam, down 3.15 percent from the opening, against a 52 week low of 30.335 euros and an all time high of 42.54 euros set in March.
• Monday 12 October 2026, 18:40NL Times reports that work has come to a standstill in multiple Albert Heijn distribution centres, with only the Zaandam centre still operating according to an email to a supplier obtained by RTL Z, and that suppliers have been asked to deliver to Zaandam only and to hold strictly to agreed time slots so that the flow of goods stays manageable. The same report puts the websites of at least eight further group chains offline, with Delhaize in Belgium and the United States banners affected. None of this operational detail has been confirmed by the companies.

Thirty hours, and a clear line between what the two companies have stated, what has been reported by others and what nobody has said at all. The third column is where commentary on an unattributed incident usually goes wrong.

Why this one is different

Begin with the definition rather than the incident. Article 7(1)(a) of the Market Abuse Regulation defines inside information as information of a precise nature, which has not been made public, relating, directly or indirectly, to one or more issuers or to one or more financial instruments, and which, if it were made public, would be likely to have a significant effect on the prices of those financial instruments or on the price of related derivative financial instruments. Article 7(4) supplies the significance test: information a reasonable investor would be likely to use as part of the basis of his or her investment decisions. A group wide security incident that has stopped online ordering in the Netherlands, with the same systems reported down at Delhaize in Belgium and reported effects across the distribution network, clears that bar without argument.

Then the duty. It opens in one sentence. An issuer shall inform the public as soon as possible of inside information which directly concerns that issuer. There is no grace period in it, no reference to completing an investigation, and no allowance for the fact that your forensics provider arrived four hours ago.

What boards reach for next is Article 17(4), the delay provision. It is real, and it is considerably narrower than its reputation. An issuer may delay disclosure on its own responsibility only where all three of these conditions are met: immediate disclosure is likely to prejudice its legitimate interests; delay of disclosure is not likely to mislead the public; and the issuer is able to ensure the confidentiality of that information. The first two are judgement calls a well advised board can take during a live incident. The third is a question of fact, and an incident that takes the customer app, the website and the delivery service offline answers it before anyone has convened. Article 17(7) then closes the loop: where disclosure has been delayed and confidentiality is no longer ensured, the issuer must disclose as soon as possible, and that expressly covers the case where a rumour is accurate enough to show that confidentiality has gone.

Article 17(4) of the Market Abuse Regulation lets an issuer delay disclosure only when all three conditions are met. Two of them are matters of judgement during a live incident. The third is a matter of fact, and a customer facing outage settles it.

The practical effect is uncomfortable. For a consumer facing listed business, the timing of disclosure is decided by the attacker's choice of target rather than by the board. Compromise a back office system nobody outside can see and there is room to assess. Reach the systems customers touch and you are publishing within hours, with nothing to publish. Ahold Delhaize's statement runs to roughly seventy words and asserts four things: there is a security issue, we are assessing and mitigating it, we have taken some systems offline, the stores are open. As corporate communications it is unsatisfying. As an Article 17(1) disclosure drafted before any finding existed, it is close to correct, and the discipline of saying nothing beyond what is known is harder than it looks at seven in the morning.

A second clock runs alongside it inside the European Union. Article 23 of NIS2 requires essential and important entities to send an early warning to their CSIRT or competent authority within 24 hours of becoming aware of a significant incident, a fuller notification within 72 hours, and a final report within one month of that notification. Annex II lists production, processing and distribution of food, covering food businesses as defined in Article 3, point (2), of Regulation (EC) No 178/2002 which are engaged in wholesale distribution and industrial production and processing. Whether a particular entity in a group falls inside that qualifier is a matter of national transposition and an entity by entity assessment, and no authority has said anything about this group. What can be said is that the Dutch implementing law, the Cyberbeveiligingswet, has been in force since 15 August 2026 without a general transition period, so for Dutch entities in scope the obligation is live rather than pending.

Note what the trigger does in both regimes. The MAR duty and the NIS2 clock attach to knowledge, not to visibility. The outage became public on Sunday afternoon. When the underlying incident began, and when anyone inside first knew of it, has not been stated by either company. Those are different dates, and in a regulatory review they are the only dates that matter.

The commercial exposure for UK organisations

Regulatory. The reflex is to reach for the cyber rulebook. For a UK grocer that rulebook is empty. The Network and Information Systems Regulations 2018 cover electricity, oil and gas, air, water, rail and road transport, healthcare, drinking water and digital infrastructure. Food retail is not in Schedule 2, and the Bill as introduced does not add it. The Bill extends the regime to managed service providers and data centres, and the government's factsheet sets out what it introduces: a light touch notification to the regulator, sighting the NCSC, within 24 hours of becoming aware that an incident is taking place, limited to the entity's name, the service affected and brief details, followed by a fuller report after 72 hours. Those measures will be commenced by secondary legislation after Royal Assent. Useful, and not applicable to a supermarket. What is applicable, immediately and without any commencement regulations, is UK MAR, whose Article 17(1) opening duty stands word for word as in the EU original, the rest of the paragraph having been re-pointed to UK venues and UK mechanisms. For a listed UK consumer business the binding deadline on day one of a cyber incident is a securities deadline enforced by the FCA, and it is the one most incident response plans treat as somebody else's workstream. If personal data later turns out to be involved, UK GDPR Article 33 adds its own 72 hour clock to the ICO, also running from awareness rather than from confirmation.

Financial. The shares closed 3.15 percent below the opening on the day of the announcement. That is a modest move and the wrong number to fixate on. The larger cost sits in the operations the announcement describes: a delivery business that cannot deliver, a distribution network reportedly reduced for a period to a fraction of its sites, and a fresh produce supply chain whose inventory does not wait for the restore. Add the compensation already promised to customers whose personal discounts failed, and a shelf label discrepancy the company has flagged without yet saying how it will be resolved. Each is small per unit and substantial at national scale, and none of them appears in a cyber risk quantification exercise built around records lost.

Contractual. The supplier dimension here deserves more attention than it will get. Suppliers were reportedly asked, at effectively no notice, to redirect deliveries to a single site and hold to agreed slots. That is a rational containment measure, and it transfers cost and risk directly onto third parties. Most supply agreements say a great deal about what happens when a supplier fails and very little about what happens when a customer's incident forces the supplier to reconfigure. If you sell into large retailers, manufacturers or logistics operators, settle who absorbs that cost in writing, before you find out in an email at seven in the morning.

Governance. The sequencing is the governance finding. The operating company published to customers at 07:24. The issuer published to the market at 08:29. In this case the order worked and the gap was short. The general risk is plain: in most groups, brand and customer communications can publish without the disclosure committee seeing the wording, and the moment they do, the confidentiality condition in Article 17(4) is gone and Article 17(7) applies. A well meaning status page update can start a statutory clock the board does not know is running.

What leaders should do now

1. Draft the holding statement now, and get it approved now. Sixty to eighty words. No cause, no attacker, no numbers, no restoration date. Signed off in advance by the board, the data protection lead and external counsel, so that publishing it on the night is an execution step rather than a drafting exercise conducted by exhausted people. Ahold Delhaize's statement is a serviceable model, and it is instructive precisely because it says so little.

2. Name who can authorise an issuer announcement outside business hours, and name the deputy. As soon as possible is measured against your capacity to act, not your opening times. This incident started on a Sunday afternoon. If the honest answer involves waiting for Monday, you have found your gap without needing an exercise.

3. Sequence the customer statement and the market announcement in a single plan. Decide now which goes first, who signs each, and what triggers them. Then establish who outside that plan has the technical ability to publish a customer notice, a status page update or an in-app message, and either remove it or bring them inside the plan.

4. Run notification as a parallel workstream, not a downstream one. Containment, forensics, supplier triage and restoration belong to one owner. Notification to markets, regulators and customers belongs to another, with fixed deadlines that do not wait for findings. Where an entity in the group is in scope of NIS2, those deadlines include the 24 hour early warning and the 72 hour notification under Article 23.

5. Read your supply contracts from the other side of the table. If a major customer suffers an incident and reroutes your deliveries at no notice, who pays? If you are the large customer, what have you actually reserved the right to require? Neither question is difficult. Both are usually unanswered.

6. Separate the date you became aware from the date it became visible, in your own logging. Both the market duty and the regulatory duty run from awareness. If your timeline cannot evidence when you knew, you will be defending a position you cannot prove.

Five actions on the disclosure path rather than the attack path. None of them requires a procurement cycle, and the first two can be finished inside a fortnight.

Three questions for the board

1. If our customer facing systems went dark tonight, who writes the market announcement, who approves it, and have we read the actual words? Not the policy that says an announcement will be made. The words.

2. Which teams can publish something customer facing without the disclosure committee seeing it first? Each of them can remove our right to delay under Article 17(4) without knowing that is what they have done.

3. Our incident plan has a containment timeline. Does it have a notification timeline, and do the two run in parallel? If notification sits downstream of forensics, the plan has the sequence the regulation does not allow.

Strategic takeaway

Boards fund detection and response because the failure mode is easy to picture. The disclosure path gets an appendix, usually drafted by someone who has never had to publish under it. Yet the disclosure path is the part with a statutory deadline, a named regulator, a share price attached and no technical remedy available. It is also the cheapest part of incident readiness to fix, because fixing it takes decisions and drafting rather than tooling and a procurement cycle.

The first casualty of a cyber incident at a listed company is not data. It is the option to wait. Ahold Delhaize lost that option the moment its customers noticed, which was before anyone had anything to tell them. Whatever this incident turns out to have been, that part of it is already a finished lesson, and it is considerably cheaper to learn from somebody else's Sunday afternoon than from your own.

Confidence note

Confirmed, and sourced to the companies. The incident and its start on Sunday afternoon, the preventive shutdown of systems, the unavailability of websites, apps, customer service and logistics, the suspension of online deliveries, that stores remained open with working tills, the electronic shelf label discrepancy and the compensation undertaking, and the Article 7(1) filing. All from Albert Heijn's media statement of 12 October 2026 and Ahold Delhaize's group statement of the same date.

Reported, and not confirmed by either company. The distribution centre standstill, the single operating site, the instruction to suppliers, the share price movement and a third party expectation of significant financial loss. These come from NL Times of 12 October 2026, in part citing RTL Z and an email seen by it, and neither company has addressed them.

Not established at all. The cause. The attacker. The point of entry. Whether ransomware is involved. Whether any personal data was accessed. When services will be restored. Reporting by RTL that the signs indicate the group has fallen victim to cybercriminals is that outlet's assessment rather than a finding, and is not relied on here. The argument in this briefing does not depend on any of these being resolved in either direction.

Assessed, and labelled as ours. The condition by condition reading of Article 17(4) against a consumer facing outage. The read across to UK MAR, the UK NIS Regulations 2018, the Cyber Security and Resilience Bill and UK GDPR Article 33. The six actions and the three board questions. None of this is the stated position of either company or of any regulator and it should not be read as such. The regulatory wording is quoted from Regulation (EU) No 596/2014 as published on legislation.gov.uk and from the GOV.UK factsheet, not paraphrased from memory.

Context, carried at arm's length. Ahold Delhaize USA disclosed a separate incident dating to November 2024, reported by security trade outlets as affecting 2,242,521 individuals in a filing with the Maine Attorney General, and claimed by the INC Ransom group, which listed the company in April 2025. It is included here only to note that this is the group's second disclosed incident inside two years. No evidence connects the two, and none is implied.

Garzon Cyber Solutions delivers cybersecurity advisory, compliance certification and specialist technology recruitment as one integrated capability for organisations in the UK, EU and beyond.