--- title: "SpySecure® | After a cyber attack: why recovery takes weeks" description: After a cyber attack you rebuild, not just restore. Why recovery takes weeks, why a backup is not enough and why stopping attacks early matters. image: https://www.spysecure.nl/hubfs/B10_featured_image_EN-1.png --- ✓ Trusted by **100+** businesses★★★★★ **5.0** on Google[View our plans →](https://www.spysecure.nl/en/cybersecurity-packages?hsLang=en) [![SpySecure](https://www.spysecure.nl/hs-fs/hubfs/SpySecure%20logo/logo%201%20(bold)%20-%20no%20white%20space%20-%20resized.png?width=200&height=40&name=logo%201%20(bold)%20-%20no%20white%20space%20-%20resized.png)](https://www.spysecure.nl/en/?hsLang=en) - Cybersecurity for businesses - All-in-one cybersecurity - Who it's for - Our approach - Pricing [NL](https://www.spysecure.nl/kennis/herstel-na-cyberaanval-mkb)[EN](https://www.spysecure.nl/en/knowledge/recovery-after-cyber-attack-sme) [Contact](https://www.spysecure.nl/en/contact?hsLang=en) - [Why cybersecurity?Risks and consequences for SMEs](https://www.spysecure.nl/en/why-cybersecurity-sme?hsLang=en) - [What security do you need?The security layers explained](https://www.spysecure.nl/en/security-layers-smes?hsLang=en) - [BlogInsights and current threats](https://www.spysecure.nl/en/knowledge) - [WebinarsJoin live or watch on demand](https://www.spysecure.nl/events?hsLang=en) - [FAQQuick answers to your questions](https://www.spysecure.nl/en/faq?hsLang=en) NIS2 Does NIS2 apply to your business? Read what the law requires and how to show your security is in order. [Go to NIS2 →](https://www.spysecure.nl/en/nis2?hsLang=en) [Managed SecurityAll security layers, fully managed and monitored 24/7→](https://www.spysecure.nl/en/managed-security?hsLang=en) [Security layers](https://www.spysecure.nl/en/approach?hsLang=en) - [Endpoints / devices](https://www.spysecure.nl/en/endpoint-security?hsLang=en) - [M365 & Google Workspace](https://www.spysecure.nl/en/microsoft-365-google-workspace-security?hsLang=en) - [Cloud & SaaS](https://www.spysecure.nl/en/cloud-security?hsLang=en) - [Email](https://www.spysecure.nl/emailbeveiliging?hsLang=en) - [Identities](https://www.spysecure.nl/identiteitenbeveiliging?hsLang=en) - [Backups](https://www.spysecure.nl/backups?hsLang=en) Training - [Employee training](https://www.spysecure.nl/en/training?hsLang=en) - [Phishing test](https://www.spysecure.nl/en/phishing-test?hsLang=en) Compliance - [Compliance management](https://www.spysecure.nl/en/compliance?hsLang=en) - [NIS2 compliance](https://www.spysecure.nl/en/nis2?hsLang=en) Scans & extras - [Vulnerability scan](https://www.spysecure.nl/en/vulnerability-scan?hsLang=en) - [Penetration test](https://www.spysecure.nl/pen-test?hsLang=en) - [Business password manager](https://www.spysecure.nl/en/business-password-manager?hsLang=en) - [Domain protection](https://www.spysecure.nl/en/domainprotection?hsLang=en) Plans From €9.99 per licence per month. Fully managed, including all the security software you need. [View the plans →](https://www.spysecure.nl/en/cybersecurity-packages?hsLang=en) Businesses - [Startups & scale-ups](https://www.spysecure.nl/en/business-cybersecurity?hsLang=en) - [SMEs](https://www.spysecure.nl/en/business-cybersecurity?hsLang=en) Sectors - [E-commerce](https://www.spysecure.nl/en/cybersecurity-ecommerce?hsLang=en) - [Education](https://www.spysecure.nl/en/business-cybersecurity?hsLang=en) - [Healthcare](https://www.spysecure.nl/en/business-cybersecurity?hsLang=en) - [Professional services](https://www.spysecure.nl/en/business-cybersecurity?hsLang=en) Partners - [MSPs](https://www.spysecure.nl/en/partners?hsLang=en) - [IT partners](https://www.spysecure.nl/en/partners?hsLang=en) Customer stories ★★★★★ Trusted by 100+ businesses Read how business owners placed their security with us. [Read the customer stories →](https://www.spysecure.nl/en/our-customers?hsLang=en) - [Our approachHow we secure your business](https://www.spysecure.nl/en/approach?hsLang=en) - [How it worksFrom introduction to 24/7 monitoring](https://www.spysecure.nl/en/how-it-works?hsLang=en) - [Customer storiesExperiences of our customers](https://www.spysecure.nl/en/our-customers?hsLang=en) - [About usThe team behind SpySecure®](https://www.spysecure.nl/en/about-us?hsLang=en) Google reviews ★★★★★ 5.0 on Google Our customers rate us 5 stars. [What our customers say →](https://www.spysecure.nl/en/our-customers?hsLang=en) - [All-in-one plansFully managed · from €9.99 per licence](https://www.spysecure.nl/en/cybersecurity-packages?hsLang=en) - [Individual servicesPer service · from €4.99 per licence](https://www.spysecure.nl/en/security-services?hsLang=en) [![SpySecure](https://www.spysecure.nl/hs-fs/hubfs/SpySecure%20logo/logo%201%20(bold)%20-%20no%20white%20space%20-%20resized.png?width=200&height=40&name=logo%201%20(bold)%20-%20no%20white%20space%20-%20resized.png)](https://www.spysecure.nl/en/?hsLang=en) Cybersecurity for businesses - [Why cybersecurity?Risks and consequences for SMEs](https://www.spysecure.nl/en/why-cybersecurity-sme?hsLang=en) - [What security do you need?The security layers explained](https://www.spysecure.nl/en/security-layers-smes?hsLang=en) - [BlogInsights and current threats](https://www.spysecure.nl/en/knowledge) - [WebinarsJoin live or watch on demand](https://www.spysecure.nl/events?hsLang=en) - [FAQQuick answers to your questions](https://www.spysecure.nl/en/faq?hsLang=en) All-in-one cybersecurity [Managed SecurityAll security layers, fully managed and monitored 24/7→](https://www.spysecure.nl/en/managed-security?hsLang=en) [Security layers](https://www.spysecure.nl/en/approach?hsLang=en) - [Endpoints / devices](https://www.spysecure.nl/en/endpoint-security?hsLang=en) - [M365 & Google Workspace](https://www.spysecure.nl/en/microsoft-365-google-workspace-security?hsLang=en) - [Cloud & SaaS](https://www.spysecure.nl/en/cloud-security?hsLang=en) - [Email](https://www.spysecure.nl/emailbeveiliging?hsLang=en) - [Identities](https://www.spysecure.nl/identiteitenbeveiliging?hsLang=en) - [Backups](https://www.spysecure.nl/backups?hsLang=en) Training - [Employee training](https://www.spysecure.nl/en/training?hsLang=en) - [Phishing test](https://www.spysecure.nl/en/phishing-test?hsLang=en) Compliance - [Compliance management](https://www.spysecure.nl/en/compliance?hsLang=en) - [NIS2 compliance](https://www.spysecure.nl/en/nis2?hsLang=en) Scans & extras - [Vulnerability scan](https://www.spysecure.nl/en/vulnerability-scan?hsLang=en) - [Penetration test](https://www.spysecure.nl/pen-test?hsLang=en) - [Business password manager](https://www.spysecure.nl/en/business-password-manager?hsLang=en) - [Domain protection](https://www.spysecure.nl/en/domainprotection?hsLang=en) Who it's for Businesses - [Startups & scale-ups](https://www.spysecure.nl/en/business-cybersecurity?hsLang=en) - [SMEs](https://www.spysecure.nl/en/business-cybersecurity?hsLang=en) Sectors - [E-commerce](https://www.spysecure.nl/en/cybersecurity-ecommerce?hsLang=en) - [Education](https://www.spysecure.nl/en/business-cybersecurity?hsLang=en) - [Healthcare](https://www.spysecure.nl/en/business-cybersecurity?hsLang=en) - [Professional services](https://www.spysecure.nl/en/business-cybersecurity?hsLang=en) Partners - [MSPs](https://www.spysecure.nl/en/partners?hsLang=en) - [IT partners](https://www.spysecure.nl/en/partners?hsLang=en) Our approach - [Our approachHow we secure your business](https://www.spysecure.nl/en/approach?hsLang=en) - [How it worksFrom introduction to 24/7 monitoring](https://www.spysecure.nl/en/how-it-works?hsLang=en) - [Customer storiesExperiences of our customers](https://www.spysecure.nl/en/our-customers?hsLang=en) - [About usThe team behind SpySecure®](https://www.spysecure.nl/en/about-us?hsLang=en) Pricing - [All-in-one plansFully managed · from €9.99 per licence](https://www.spysecure.nl/en/cybersecurity-packages?hsLang=en) - [Individual servicesPer service · from €4.99 per licence](https://www.spysecure.nl/en/security-services?hsLang=en) [Contact](https://www.spysecure.nl/en/contact?hsLang=en) [NL](https://www.spysecure.nl/kennis/herstel-na-cyberaanval-mkb)[EN](https://www.spysecure.nl/en/knowledge/recovery-after-cyber-attack-sme) Cyber attack Backup & Recovery # After a cyber attack: why recovery takes weeks After a cyber attack you rebuild, not just restore. Why recovery takes weeks, why a backup is not enough and why stopping attacks early matters. 3 November 2026 ![SpySecure](https://www.spysecure.nl/hubfs/icon%201%20-%20no%20white%20-%20resized.png) SpySecure [![Timeline of the Albert Heijn cyber incident in October 2026: systems switched off on 11 October, home delivery restarted on 23 October, 12 days later.](https://www.spysecure.nl/hubfs/B10_featured_image_EN-1.png)](https://www.spysecure.nl/hubfs/B10_featured_image_EN-1.png?hsLang=en) Click to enlargeTap to enlarge On Sunday 11 October 2026, Albert Heijn and its parent company Ahold Delhaize detected suspicious activity in their IT systems. Systems were switched off to stop the attackers. The next day, work stopped at several distribution centres and shelves emptied. Home delivery only restarted, step by step, on 23 October. The company quickly brought in cybersecurity experts, and says there is no evidence that sensitive data was taken. Even so, home delivery was out for almost two weeks. What would that mean for an SME without its own IT department? Many SMEs think: we have a backup, so we can restore. This article explains what recovery after an attack really involves, why a backup is not enough, and why stopping an attack early matters most. **Jump to:** [Recovery steps](https://www.spysecure.nl/en/knowledge/recovery-after-cyber-attack-sme#rebuild) [Why backup is not enough](https://www.spysecure.nl/en/knowledge/recovery-after-cyber-attack-sme#backup) [Stop attacks early](https://www.spysecure.nl/en/knowledge/recovery-after-cyber-attack-sme#early) [5-step checklist](https://www.spysecure.nl/en/knowledge/recovery-after-cyber-attack-sme#checklist) ## What does recovery after a cyber attack involve? After a serious attack, you cannot trust anything the attackers may have touched. You do not just restore. You rebuild: 1 **Investigate** Find out how the attackers got in, what they touched and whether they are still inside. Otherwise they come back. 2 **Wipe and reinstall devices** Laptops and servers are wiped. The operating system and all software are installed again. 3 **Rebuild accounts and cloud** Reset passwords and MFA, and check admin accounts, connected apps and settings. Sometimes a completely new Microsoft 365 or Google Workspace environment is needed. 4 **Clean and restore data** Find a backup from before the attack, check that it is clean, and upload the data again. 5 **Set up your tools again** Settings, links between apps and workflows in your CRM, accounting software and other tools. 6 **Test and restart** Check that everything works and is safe before employees start again. Each step takes time and specialists. During all of it, your company cannot work normally: orders, invoicing and customer contact slow down or stop. ## Why is a backup not enough? A backup is essential. But it only solves one of the six steps above.   ### A backup returns data, not a working company Devices, accounts, settings and links between tools still have to be rebuilt by hand.   ### The backup must be clean Attackers are sometimes inside for days or weeks before they strike. Recent backups can contain their traces, so you may have to go further back and lose more work.   ### Built-in restore options are limited Microsoft 365 and Google Workspace can bring back deleted items for a limited time. That helps after a mistake. It does not cover laptops, servers or your other apps, and an attacker with admin rights can remove it. So a backup is the last line of defence. It decides whether you can recover at all. It does not decide how long that takes. ## Why does stopping an attack early matter most? How much you need to rebuild depends on how far the attackers got. Compare: Stopped early One laptop is isolated and one account is reset. The rest of the company keeps working. Discovered late Every device, account and system is suspect. Everything has to be checked or rebuilt. At Albert Heijn, according to sources of Dutch broadcaster NOS, switching systems off quickly appears to have stopped the attackers from getting deeper into the network. For an SME, the best outcome is that attackers never get in. Many attacks start with a stolen password, a phishing e-mail or a missing update. Read how to make sure [MFA is required on every account](https://www.spysecure.nl/en/knowledge/mfa-not-enforced-microsoft-365-google-workspace?hsLang=en) and [who installs your security updates](https://www.spysecure.nl/en/knowledge/patch-management-sme-security-updates?hsLang=en). ## Checklist: 5 steps to limit the damage of an attack Prevention comes first. Then make sure you notice an attack quickly, and that you can recover if it still goes wrong. 1 ### Close the common entry points MFA on every account, security updates on every device, and employees who recognise phishing. 2 ### Watch day and night Make sure someone can isolate a device or block an account within minutes, also at night and at weekends. 3 ### Keep separate, tested backups Cloud e-mail and files, laptops, servers and key apps. Out of reach of attackers. Restore real data at least once a year. 4 ### Document your setup Write down the settings, links and workflows of your tools. That saves days when you have to rebuild them. 5 ### Agree who does what Who decides to switch systems off, which specialists you call and how you inform customers. Keep a printed copy. ## In short - Recovering from a serious attack means rebuilding devices, accounts, tools and data. That takes weeks, not hours. - A backup returns your data, not a working company. - Preventing attacks and stopping them early limits the damage most. SpySecure can take this off your hands. Our [cybersecurity plans](https://www.spysecure.nl/en/cybersecurity-packages?hsLang=en) include 24/7 monitoring and response, so attacks are stopped early. The Advanced plan adds backups of your devices and cloud data. See which [security layers your SME needs](https://www.spysecure.nl/en/security-layers-smes?hsLang=en). Contact ## Want to know how quickly an attack on your company would be stopped? Leave your details and we will get in touch to look at your situation together.   Sources - [NL Times: Albert Heijn files police report, confirms suspicious activity (19 October 2026)](https://nltimes.nl/2026/10/19/albert-heijn-files-police-report-confirms-suspicious-activity-cyberattack-attempt) - [DutchNews: Albert Heijn begins restocking as hack traced to foreign servers (October 2026)](https://www.dutchnews.nl/2026/10/albert-heijn-begins-restocking-as-hack-traced-to-foreign-servers/) - [IBTimes: Albert Heijn deliveries resume after cyber incident (October 2026)](https://www.ibtimes.co.uk/albert-heijn-deliveries-resume-after-cyber-incident-1826826) [Cyber attack](https://www.spysecure.nl/en/knowledge/tag/cyber-attack) [Backup & Recovery](https://www.spysecure.nl/en/knowledge/tag/backup-recovery) In this article [![SpySecure](https://www.spysecure.nl/hs-fs/hubfs/SpySecure%20logo/logo%20white%20(bold)%20-%20transparent%20-%20sized.png?width=200&height=34&name=logo%20white%20(bold)%20-%20transparent%20-%20sized.png)](https://www.spysecure.nl/en/?hsLang=en) Fully managed cybersecurity, training and compliance for scale-ups and SMEs. - 24/7 monitoring, detection and response - Monthly reporting ### Solutions - [Managed Security](https://www.spysecure.nl/en/managed-security?hsLang=en) - [Compliance](https://www.spysecure.nl/compliance?hsLang=en) - [Security Awareness Training](https://www.spysecure.nl/training?hsLang=en) - [NIS2](https://www.spysecure.nl/nis2?hsLang=en) - [Domain protection](https://www.spysecure.nl/domeinbescherming?hsLang=en) - [For IT partners](https://www.spysecure.nl/partners?hsLang=en) ### Pricing - [All-in-one plans](https://www.spysecure.nl/en/cybersecurity-packages?hsLang=en) - [Individual services](https://www.spysecure.nl/en/security-services?hsLang=en) ### Resources - [Events and webinars](https://www.spysecure.nl/events?hsLang=en) - [Blog](https://www.spysecure.nl/kennisbank?hsLang=en) - [FAQ](https://www.spysecure.nl/en/faq?hsLang=en) - [Customer stories](https://www.spysecure.nl/en/our-customers?hsLang=en) ### Contact - [Book an introduction](https://www.spysecure.nl/en/contact?hsLang=en) - [contact@spysecure.nl](mailto:contact@spysecure.nl) - [+31 20 261 2897](tel:+31202612897) ### Newsletter Once a month: the key threats and tips for your business. Ask AI about SpySecure®[ChatGPT](https://chatgpt.com/?q=Explain+what+SpySecure+%28spysecure.nl%29+does%3A+how+it+helps+SMEs+and+scale-ups+with+fully+managed+cybersecurity+and+compliance+%28NIS2%2C+ISO+27001%2C+SOC+2%29%2C+what+the+packages+include+and+what+its+key+benefits+are.)[Claude](https://claude.ai/new?q=Explain+what+SpySecure+%28spysecure.nl%29+does%3A+how+it+helps+SMEs+and+scale-ups+with+fully+managed+cybersecurity+and+compliance+%28NIS2%2C+ISO+27001%2C+SOC+2%29%2C+what+the+packages+include+and+what+its+key+benefits+are.)[Gemini](https://gemini.google.com/app?q=Explain+what+SpySecure+%28spysecure.nl%29+does%3A+how+it+helps+SMEs+and+scale-ups+with+fully+managed+cybersecurity+and+compliance+%28NIS2%2C+ISO+27001%2C+SOC+2%29%2C+what+the+packages+include+and+what+its+key+benefits+are.)[Perplexity](https://www.perplexity.ai/search?q=Explain+what+SpySecure+%28spysecure.nl%29+does%3A+how+it+helps+SMEs+and+scale-ups+with+fully+managed+cybersecurity+and+compliance+%28NIS2%2C+ISO+27001%2C+SOC+2%29%2C+what+the+packages+include+and+what+its+key+benefits+are.)[Copilot](https://copilot.microsoft.com/?q=Explain+what+SpySecure+%28spysecure.nl%29+does%3A+how+it+helps+SMEs+and+scale-ups+with+fully+managed+cybersecurity+and+compliance+%28NIS2%2C+ISO+27001%2C+SOC+2%29%2C+what+the+packages+include+and+what+its+key+benefits+are.)[Grok](https://grok.com/?q=Explain+what+SpySecure+%28spysecure.nl%29+does%3A+how+it+helps+SMEs+and+scale-ups+with+fully+managed+cybersecurity+and+compliance+%28NIS2%2C+ISO+27001%2C+SOC+2%29%2C+what+the+packages+include+and+what+its+key+benefits+are.) © SpySecure® 2026. All rights reserved. [Privacy](https://www.spysecure.nl/privacy-policy?hsLang=en)[Cookies](https://www.spysecure.nl/cookie-policy?hsLang=en)[Terms](https://www.spysecure.nl/en/terms?hsLang=en)