- Ahold Delhaize estimates its October cyberattack will cut fourth-quarter net sales by €200 million to €250 million and operating income by €75 million to €100 million.
- The company took some systems offline, mainly affecting online services and Benelux supply chains. It does not say how much of the lost sales came from the shutdown versus the attack itself.
- Ask your team which systems it would switch off in an incident, what revenue depends on each, and who decides.
A cyberattack priced in the guidance
Most cyber incidents are described in technical terms. Ahold Delhaize described this one in financial terms. With its third-quarter results on November 4, the grocer put numbers on an October cyberattack.
The company estimates the incident will reduce fourth-quarter net sales by €200 million to €250 million. It expects underlying and IFRS operating income to be €75 million to €100 million lower. These are estimates, which the company bases on current information.
Separately, it says the incremental response and remediation costs will be marginal for its 2026 IFRS operating income. That remark covers only that one measure and only the added costs of responding and cleaning up.
What the company took offline
Ahold Delhaize says its incident protocols led it to take some systems offline to protect its IT environment. CEO Frans Muller says the main effects, to differing degrees, were on online services in the Benelux and the U.S. and on Benelux supply-chain operations. The online retailer bol was not affected.
Isolating systems is a common way to contain an intrusion. If attackers cannot reach a system, they cannot spread through it. The trade-off is that customers cannot use it either. For a grocer, that means online orders and the logistics behind them.
The company says it could not always give customers the service they expect. It apologised and is offering promotions and small gestures as shoppers return.
One reading of the numbers
This section is our interpretation, not the company's. Compare like with like. The company puts the operating income hit at €75 million to €100 million. It calls the added response and remediation costs marginal for 2026 IFRS operating income.
On those figures, the lost trading looks much larger than the cleanup bill. The channels the company names as hit are also the ones it took offline. That suggests the biggest exposure sat in the operations that stopped, not only in the technical repair.
The sources do not prove that link. Ahold Delhaize attributes the loss to the incident as a whole. It does not split lost sales between the deliberate shutdown and the attack itself. It has also not said what type of attack it faced, according to SecurityWeek. This is one company's estimate, not a pattern.
Why online sales raise the stakes
The third quarter ended before the attack, so these figures describe the business before it. Ahold Delhaize says U.S. online sales grew 14.2% at constant exchange rates in that quarter. It describes ten consecutive quarters of growth above 10%.
The company does not say how much of that online business was disrupted, only that channels were affected to differing degrees. Still, the more sales run through connected systems, the more it costs when some of them go dark.
What is still open
The company confirmed the cyberattack on October 19. SecurityWeek reports it said then that it had no evidence customer, associate or partner data had been stolen. That is a statement from that date, and the sources give no later update.
Muller says the bulk of the disruption was under control within two weeks. Full recovery is still under way. The company has not said how much of the €200 million to €250 million falls in those first two weeks and how much comes later.
The wider outlook has also moved. Ahold Delhaize now expects diluted underlying earnings per share to grow in the low single digits at constant exchange rates, down from mid- to high-single digits. It now guides to about €2.1 billion in free cash flow, against at least €2.3 billion before. It ties that cut to the incident and to new supplier payment rules in Serbia, so the attack is not the only cause.
SecurityWeek also recalls a November 2024 ransomware attack on several of the company's U.S. brands, claimed by the INC Ransom group. The company later said the personal data of more than 2.2 million people was affected. That was a separate incident.
Questions to put to your team
Start with the shutdown decision. Which systems would we take offline first in an incident, and how much revenue depends on each one? If nobody can answer in euros or dollars, the board cannot yet weigh containment against sales.
Next, ask who may make that call and how fast. A pre-agreed playbook makes the trade-off deliberately. Without one, it gets made under pressure.
Then ask how long each critical channel can run in a degraded mode. Can orders be taken by hand, or deliveries routed another way?
Finally, ask how quickly finance could size the damage. Ahold Delhaize published a range about two weeks after confirming the attack, as part of its quarterly results. The sources do not say how it prepared that estimate. Ask whether your own team could produce a comparable range on a similar timeline.
Muller says the incident does not define the business. That may be fair. It still defines a quarter, and the company puts a price on it.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Ahold Delhaize.
