Cyber incident at Ahold Delhaize: *when the clock started, and what the logs show*

When the incident started

On Sunday 10 November 2024, Ahold Delhaize reported a cyber incident affecting its stores in the US, the Netherlands and Belgium ^[1]. The Dutch chains Albert Heijn, Etos and Gall & Gall told customers that deliveries, self-scanning and some in-store services were unavailable. The company said it was working to restore services but gave no timeline.

Cyber incidents are common enough. What makes this one worth looking at is the reporting question: when did the organisation become aware, and can it show that it reported within the deadlines?

The 24-hour rule

Sweden's Cybersecurity Act, which implements the EU's NIS2 directive, came into force on 15 January 2026 ^[2]. Essential and important entities in 18 sectors must manage ICT risk and report significant incidents in three steps: an early warning within 24 hours of becoming aware, an incident notification within 72 hours, and a final report within a month.

The 24-hour clock works like when you lose your bank card: it starts when you notice, not when it suits you. The law says within 24 hours of becoming aware, so the first thing an organisation needs to know is when detection happened. That sounds simple until you have to show it to a supervisor.

Say the security team spotted unusual activity on Sunday evening but escalated it on Monday morning. Did awareness start at detection or at escalation? The question matters, and the answer is in the records.

What DORA asks for

For financial entities, DORA has applied since January 2025. One detail in its technical standard on ICT risk management deserves more attention than it gets: logs must be protected against tampering, deletion and unauthorised access ^[3].

Logs are what tell you what happened during an incident. It isn't enough that they exist. People have to be able to trust them. A log its own operator can quietly edit is a diary, not evidence.

The question for an organisation like Ahold Delhaize, or any entity that falls under the Cybersecurity Act, is whether it can show when detection happened and that the incident timeline hasn't changed since it was written.

How a digital witness helps

Here, the thing to seal is each step of the incident as it happens: the first detection note, the decision to escalate, and each report as it is sent.

Your system sends a fingerprint of each record, not the record itself, to WitniumChain through the REST API, the SDK or the MCP server, and gets a witness ID back. To check, anyone you share the record with—a supervisor, an auditor or an insurer—calculates the fingerprint again and compares it with the sealed one. The first 2,000 witnesses a month are free. Read the docs.

Sealing shows when each step was recorded, in a way nobody can quietly rewrite afterwards. It doesn't show that the report was complete or that the response was adequate, but it does settle the question of when awareness started.

The same idea applies to the logs themselves. Seal log segments at short intervals, for example every few minutes. That way, internal audit, supervisors and incident responders can check that a log segment hasn't changed since it was sealed, even by someone with administrator rights. It doesn't replace access control, monitoring or backups, but it does give the logs a quality they otherwise lack: independence.

How it would work

1. Seal the first detection event the moment it is logged.
2. Seal each escalation and each report as it is sent.
3. If questioned, show the sealed record and let the other side check the fingerprint.

What this means for you

If your organisation falls under the Cybersecurity Act or DORA, ask these questions now:

• Can we show when we first became aware of an incident, in a way a supervisor would accept?
• Could someone with administrator rights edit our logs without it showing?
• Do we have an independent record of when each report was sent?

The deadlines count the hours from awareness. If the only record of when that happened is one you could change, you start the conversation on the back foot.

What to watch

The Cybersecurity Act applies from 15 January 2026. The first incident reports under the new law will show how supervisors interpret "became aware" and what weight they give to tamper-protected logs.

For financial entities, DORA's ICT risk management requirements are already in force. The technical standard is clear: logs must be protected. What counts as protected is the question organisations are answering now.