A Luxembourg Perspective on This Year's Cyber Incidents — Part 1: Delhaize and the Chamber of Employees

Delhaize: when the ordering system stops, continuity is a decision you made months ago

On 12 October, Ahold Delhaize — the group behind Delhaize stores in Luxembourg and Belgium — confirmed a cybersecurity incident and took systems offline across its network while it investigated with external specialists ¹. The visible symptoms were familiar: websites and apps down, customer service unreachable, online ordering suspended. The less visible symptom mattered more: the system stores use to order their own stock became unavailable, and Delhaize supermarkets across Luxembourg suspended their usual ordering process ².

What happened next is the instructive part. Within days, Delhaize switched to a fallback: stores received deliveries based on their order volumes from previous weeks, and by the end of the week they could place orders again through an older system ³. Online ordering was fully operational again on Saturday 17 October — roughly a week after the disruption began — and the company reported no indications that customer data had been stolen ⁴.

A fallback like "ship stores what they ordered in recent weeks" does not get invented mid-crisis. It requires knowing which process is critical, having historical data accessible outside the compromised system, and having people authorised to switch modes. That is business continuity working as designed — and it is exactly the capability most mid-market organisations in Luxembourg have never tested. The questions this incident puts to an executive are concrete: which single system, if unavailable for seven days, stops your revenue or your service? What is the degraded mode? Who decides to activate it, and have they rehearsed it?

There is also a dependency lesson. The outage originated at a group level and cascaded into Luxembourg store operations. In a small economy, most organisations sit downstream of a shared provider, a group IT function or a handful of logistics partners. Your continuity plan has to assume that the failure may start somewhere you do not control.

CSL: "contained" is where the work starts, not where it ends

The Chamber of Employees represents more than 630,000 employees, apprentices, pensioners and jobseekers, including cross-border workers. On Saturday 1 August, its director informed members by email that "unauthorised access to certain CSL servers" had been identified. The attackers may potentially have accessed or extracted personal data: full names, email and postal addresses, private and work telephone numbers, certain financial information and, where applicable, participation in training courses ⁵.

The CSL's response followed the right sequence: systems secured, a specialist firm (Luxembourg-based Rsecure) engaged for the technical investigation, a criminal complaint announced against the perpetrators, and its Data Protection Officer designated as the channel for personal-data requests ⁵. But the CSL was also candid about the harder truth: in-depth investigations were still ongoing to determine the origin, timeframe, scope and consequences of the access.

That candour deserves attention, because it exposes a gap between how executives imagine incidents ending and how they actually end. "Contained" means the attacker's access has been cut off. It does not mean you know what was taken, who is affected, what you must notify to the CNPD and to individuals, or what people whose phone numbers and financial details may now circulate should do about phishing attempts. For an institution whose relationship with members is built on trust, the duty-of-care phase — precise communication, honest uncertainty, support for affected individuals — lasts far longer than the technical response. Organisations that have not pre-assigned ownership of that phase discover, mid-incident, that nobody is responsible for it.

Two incidents, one lesson for a small economy

A retail operations outage and a personal-data breach at a public institution look nothing alike. They land on the same point: the incident itself is rarely the decisive event. What was decided beforehand is. Delhaize could degrade gracefully because a fallback existed. The CSL could communicate credibly because it engaged specialists and said plainly what it did not yet know. In a country where supply chains, institutions and employers are this tightly interconnected, readiness is not a compliance artefact — it is the difference between a difficult week and a lasting loss of trust.

Three questions worth putting on your next management agenda:

• Which of our processes has a tested degraded mode, and which only has a hopeful assumption?
• If personal data we hold were accessed tonight, could we say within 72 hours what categories, whose, and what we are telling them?
• Who owns the work that starts after "contained" — notification, member or customer communication, evidence for regulators and insurers?

If honest answers are missing, that is normal — and fixable. This is the work Cyvalent does: senior security leadership on demand through our vCISO services for organisations that cannot staff it full-time, and Cyvalent RGX, our platform, built around keeping risks, suppliers, tasks and evidence connected — so that when an incident comes, the response and the proof do not start from zero. No tool or advisor can promise to prevent incidents like these; preparation determines how much they cost you.

Next in this series: the Differdange municipal website hack, and the compromise of data on Luxembourg state IT devices — what they say about public-sector exposure and device-level risk.