Police and the Public Prosecution Service invite Ahold to report a 'cybersecurity'

Police and the Public Prosecution Service have invited Ahold to report a cybersecurity incident that occurred at Albert Heijn. The police stated that no criminal investigation is currently underway regarding the incident. Contact was made with Ahold, but no report was received. In response, Ahold stated it would cooperate with all relevant authorities and could not make further statements regarding the delay in reporting. The police and the Public Prosecution Service emphasized that a report is crucial for successful investigation and prosecution, noting that information from victims needs to be received quickly. Ahold has reported the incident to the National Cyber Security Centre as required by law.

The dynamic presented involves a tension between official investigative necessity and corporate cooperation, complicated by a refusal or delay in reporting. The emphasis placed on the promptness of information for successful prosecution highlights a systemic friction point: the legal imperative to report versus organizational constraints or discretion regarding sensitive incidents. Ahold's response, while framed around cooperation, introduces an element of opacity regarding the timeline for disclosure, which shifts focus from the technical incident itself to procedural adherence and accountability. The existence of the alternative path—starting a criminal investigation *ex officio* without a prior report—suggests that formal reporting is not the sole gateway to accountability, implying that regulatory mechanisms offer parallel avenues when information flow is obstructed. The pattern suggests that the value placed on immediate victim information by law enforcement contrasts with corporate responses focused on controlled disclosure, raising questions about the balance between public security and corporate narrative control in digital incidents. What factors might drive this disparity in response time? Does the procedural emphasis serve to manage liability rather than facilitate recovery?