Ahold Delhaize’s cyberattack: €200–250m of lost sales, up to €100m of profit

01Why the profit hit is so large next to the lost sales

A grocer earns about four cents of operating income on a euro of sales: Ahold Delhaize’s underlying operating margin was 4.1% in July–September.¹ Lost sales alone would cost little. The chief financial officer, Jolanda Poots-Bijl, listed what else is in the estimate: “shrink, extra hours worked to get supply running, promotional actions to welcome customers back and the negative impact on, for example, lost vendor allowances and retail media”. About 80% of the sales effect is in Europe, mostly the Netherlands, and 20% in the US; because the Netherlands “was able to mitigate part of the profit impact”, the profit effect is split more evenly. Response and remediation costs come on top, with what the company calls a “marginal” effect on IFRS operating income.²

02What was disrupted, as the company told it

On Monday 12 October the group reported “a security issue within its network” and took some systems offline; stores stayed open.³ On 13 October it began a “controlled re-launch” and said it had no evidence that customer, employee or partner data was taken.⁴ On 19 October it said “the malicious actions of others” were behind it. The brands’ websites and apps had been taken offline across “most of our brands across Europe and the United States”; it had told the Dutch National Cyber Security Centre within 24 hours and filed a police report that day. Albert Heijn’s site and app were back, with home deliveries due from 23 October, and Belgian e-commerce was fully running.⁵

By 4 November the company described the damage as mainly to online shopping in the Benelux and the US and to its Benelux supply chain; its online retailer bol was not affected. The chief executive, Frans Muller, said “most of the disruption was contained within two weeks”, and the investigation continues.¹ It has not named an attacker or mentioned a ransom. The refrigeration attacks that hit Delhaize stores in Belgium on 2 November are separate; the results documents do not mention them.

What to watch: the full-year results on 17 February 2027, which will show the incident’s actual cost against this estimate.⁶