Why supermarkets should maintain a month’s emergency stock

Albert Heijn shut down its systems entirely after a cyberattack on 11 October, leaving supermarket shelves empty. René de Koster says the incident is a warning: supermarkets need to build up larger emergency stocks. “We are so used to the conveniences of everyday life. It is incredibly easy to disrupt them.”

Why did the supermarkets run out of stock so quickly?

“Albert Heijn shut down its systems across the board when the attack was discovered. Supermarkets decide themselves what products they need. They pass that information on to the central ordering centre, which sends the orders to the distribution centres. Those centres then order from suppliers. But because the systems were down, none of that could happen.

“And then the stock is gone in no time. The regional distribution centres hold about a day and a half’s worth of stock. That is enough when supplies are running normally, but as soon as that flow stops, the stock runs out quickly.”

How does supermarket supply normally work?

“Albert Heijn has four regional distribution centres: Tilburg, Pijnacker, Zaandam and Zwolle. Each supplies around two hundred supermarkets. The regional distribution centres hold the products sold every day in each supermarket – the so-called fast movers. Think of a packet of spaghetti.

“There are two national distribution centres, in Geldermalsen and Nieuwegein, for products that sell less often. The ‘slow movers’ go from there to the regional centres and then on to the supermarkets. At the regional distribution centres, everything is loaded onto roll containers for each shop and transported to its destination by lorry.

“There are also separate supply chains for things like frozen food and fresh bread. Everything has to be carefully coordinated, from orders, stocks and transport to deliveries to the shops.”

Why did online ordering resume later than supermarket deliveries?

“Albert Heijn made that decision itself, for security reasons. Online orders involve far more customer data. I think it didn’t want to risk an attacker gaining access to that information.”

Can supermarkets process orders manually in an emergency?

“Technically, that would be possible, especially for franchisees. They can work outside the system, for example by asking suppliers to deliver products directly to shops rather than to a distribution centre. Or they can send out their own vehicles, but that involves a lot of extra work and administration.”

Is this a problem specific to Albert Heijn, or could it have happened to any supermarket?

“The whole sector is built around efficiency. Albert Heijn is the best at it, with Jumbo not far behind. But Aldi and Lidl also operate with small stocks and highly optimised logistics processes.

“Supermarkets do this because they work with low margins and high volumes. On average, a supermarket makes about 3 per cent profit on a product. That amounts to a few cents. So every cent that can be saved on logistics matters.

“They also want products to be as fresh as possible when they reach the store, so consumers get products with the longest possible shelf life. If a product is stored for longer before it goes to the supermarket, some of that shelf life is lost.”

Has our food supply become very vulnerable because of this focus on efficiency?

“Yes, efficiency has a downside. If you have hardly any stock and rely on automated processes, you have little room to absorb a disruption. I think retailers have gone too far in that direction.”

So what should supermarkets do? How many days’ worth of stock should they hold?

“I’m not thinking of a few days, but rather a month. But that would be for a selection of important products. It would obviously be impossible to hold such large stocks of every product, but there’s no need to.

“You need to decide which products are essential. That includes some long-life foods, but also things like tents, blankets, lighting and emergency generators. I’m not saying supermarkets should be the ones to stock all of these. But as a society, we need a plan.”

What role should the government play?

“The government should require supermarkets to hold larger stocks of certain products. It should definitely not try to organise this itself. Retailers are much more efficient at it. Organising storage, transport and stock management is their business.

“It should also set the conditions, including any compensation and a clear division of responsibilities. One supermarket chain cannot be expected to incur the cost of emergency stocks while its competitors contribute nothing and then benefit from them during a crisis. A distribution based on market share seems logical to me. You can also agree which products will be stored where, and which companies will serve which regions.”

How much would this cost, and who should pay?

“The cost of the stock itself is fairly modest. Existing warehouses are already full, so extra storage space will be needed, and that does cost money. Supermarkets would need to incorporate the stock into their existing networks. You can’t just leave products lying around until a crisis breaks out. Even long-life foods eventually reach their use-by date, so they also need to keep moving through the supply chain. That creates extra handling and transport.

“The additional cost depends on how great a risk you want to cover. A disruption in one region – say, a flood in Zeeland – calls for something different from a nationwide crisis. You need to work through different scenarios. And who should ultimately pay is a political question. The government could potentially cover part of the cost, with the rest passed on in prices.”

Are there countries where this is better organised?

“Walmart in the United States is a good example. It is one of the world’s largest retailers of food and non-food products. Alongside its regular warehouses and distribution centres, Walmart has its own crisis centre. It deals with major disruptions across the supply chain.

“When Hurricane Katrina struck in 2005, large areas around New Orleans were flooded. Roads became impassable and the power went out. Staff couldn’t reach all the shops and there was looting. Walmart was the only company able to get goods there. It sent a few thousand lorries.

“As far as I know, Walmart does this on its own initiative, not because the government requires it to. It can also be profitable for a company to map out these kinds of risks and respond to them effectively. That helps not only with hacks or other emergencies. Things can always go wrong in the supply chain, such as a supplier going out of business. This way, you are much more resilient.”

Should we work more closely with Belgium and Germany?

“Yes. The larger the area in which you can distribute goods, the more options you have for absorbing disruptions. We do this with electricity too. The Netherlands is connected to the energy networks of neighbouring countries, which helps us cope with peaks and dips in supply and demand. We could do the same for food supplies. If part of the Netherlands is affected, stocks from another area or a neighbouring country could help make up for shortages.”

Is digital security the weakest link in our food supply?

“There are many weak links. Digital systems are vulnerable, and so is the electricity supply. Transformer stations are everywhere, usually completely unguarded, sometimes with a camera nearby. If you blow up twenty of those substations, the whole of Rotterdam would be brought to a standstill. Almost nothing could be unloaded at the port, electric lorries could no longer charge, distribution centres would stop working, food would spoil in refrigerated storage and you wouldn’t be able to bake bread. Everything runs on electricity.”

Does AI increase the risk of hacks?

“Yes, mainly because it has made hacking easier. All you need is a paid subscription to an AI company and the ability to write good prompts, and you can hack. And the more automated systems there are, the more ways there are to disrupt them. People are still a little harder to disrupt and more flexible. The more things are robotised, the greater the risk.”

Was this hack a near-disaster?

“These kinds of hacks are becoming more common. We are so used to all the conveniences, but it’s incredibly easy to disrupt our comfortable lives. And that should be a warning. But will we take it to heart? In countries where the threat from Russia is felt much more strongly, such as Finland and the Baltic states, people are much better prepared. In the Netherlands, we have experienced few incidents that have forced us to change our daily routines. I don’t expect this hack to suddenly make us prepare properly.”