Ahold Delhaize has kept parts of its digital estate offline after malicious activity was detected in its infrastructure, disrupting online ordering and other services across parts of its retail network in Europe and the United States.
The company’s physical stores largely continued trading, but the incident showed how little separation there can be between a retailer’s public-facing technology and the systems that keep products moving behind the scenes. Distribution, stock management, e-commerce and customer services can all depend on shared infrastructure.
That creates an awkward reality during a cyber incident: the safest technical decision may be to shut systems down, even when doing so creates an immediate business problem. The quality of an incident plan is therefore measured not only by how fast systems can be isolated, but by whether the business can still function while trust is being rebuilt.
For large retailers, fallback arrangements need to go beyond IT. Teams need to know which services can run manually, how suppliers will be contacted, which transactions can be delayed and where alternative distribution processes exist.
The incident is another reminder that cyber resilience is ultimately operational resilience. An organisation can have strong security tooling and still struggle badly if it has not mapped the real-world consequences of taking critical systems offline.