--- title: "Ahold Delhaize’s cyberattack: €200–250m of lost sales, up to €100m of profit" summary: "What Ahold Delhaize said on 4 November about the cost of October’s cyberattack to its fourth quarter, what was disrupted, and why the profit hit is large next to the lost sales." url: https://www.thetechbag.com/blog/ahold-delhaize-cyberattack-cost-200-250m-euros format: Note desk: "Security" area: "Threats & vulnerabilities" region: Global published: 2026-11-06 facts_checked: 2026-11-06 author: TechBag (The TechBag Journal) tags: ["Ahold Delhaize","Albert Heijn","Delhaize","Food Lion","Netherlands","Belgium","retail cyberattack","cost of a cyberattack","guidance cut","free cash flow","e-commerce outage","supply chain disruption","NCSC Netherlands","incident disclosure"] cover: https://www.thetechbag.com/blog/covers/ahold-delhaize-cyberattack-cost-200-250m-euros.png --- # Ahold Delhaize’s cyberattack: €200–250m of lost sales, up to €100m of profit *What Ahold Delhaize said on 4 November about the cost of October’s cyberattack to its fourth quarter, what was disrupted, and why the profit hit is large next to the lost sales.* Note · Security · Threats & vulnerabilities · By TechBag · Published 2026-11-06 · Facts checked 2026-11-06 · Canonical: https://www.thetechbag.com/blog/ahold-delhaize-cyberattack-cost-200-250m-euros Ahold Delhaize, the Zaandam-based owner of Albert Heijn, Delhaize and Food Lion, expects October’s cybersecurity incident to cut its net sales for the fourth quarter by €200–250m and its operating income by €75–100m, on both its underlying and IFRS measures, it said on 4 November. It now expects free cash flow for 2026 of around €2.1bn, down from at least €2.3bn, citing the incident and new supplier payment regulations in Serbia.[1] The estimate is of business lost; the cost of the response itself, the company says, is marginal. **Figure: Ahold Delhaize expects the attack to take up to €250m of sales and €100m of operating income** *The company's estimates of the incident's effect on the October–December quarter, and its 2026 free-cash-flow guidance before and after* €200–250m Fourth-quarter net sales lost Company estimate €75–100m Fourth-quarter operating income lost Underlying and IFRS 80 / 20 Europe / US split of the sales hit, % CFO, prepared remarks €2.1bn 2026 free cash flow, from at least €2.3bn Also cites Serbian payment rules Source: Ahold Delhaize Q3 2026 release, interim report and CFO's prepared remarks · as of 4 November 2026 ## Why the profit hit is so large next to the lost sales A grocer earns about four cents of operating income on a euro of sales: Ahold Delhaize’s underlying operating margin was 4.1% in July–September.[1] Lost sales alone would cost little. The chief financial officer, Jolanda Poots-Bijl, listed what else is in the estimate: “shrink, extra hours worked to get supply running, promotional actions to welcome customers back and the negative impact on, for example, lost vendor allowances and retail media”. About 80% of the sales effect is in Europe, mostly the Netherlands, and 20% in the US; because the Netherlands “was able to mitigate part of the profit impact”, the profit effect is split more evenly. Response and remediation costs come on top, with what the company calls a “marginal” effect on IFRS operating income.[2] TechBag countThe cost against the company's own quarter At a 4.1% margin, €200–250m of sales would carry €8–10m of operating income; the estimate is €75–100m, or 30% to 50% of the lost sales. Against July–September, the sales hit is 0.9–1.1% of €23.1bn of net sales, and the profit hit is 8–11% of €946m of underlying operating income.[1] The fourth quarter is longer, at 14 weeks in a 53-week year. ## What was disrupted, as the company told it On Monday 12 October the group reported “a security issue within its network” and took some systems offline; stores stayed open.[3] On 13 October it began a “controlled re-launch” and said it had no evidence that customer, employee or partner data was taken.[4] On 19 October it said “the malicious actions of others” were behind it. The brands’ websites and apps had been taken offline across “most of our brands across Europe and the United States”; it had told the Dutch National Cyber Security Centre within 24 hours and filed a police report that day. Albert Heijn’s site and app were back, with home deliveries due from 23 October, and Belgian e-commerce was fully running.[5] By 4 November the company described the damage as mainly to online shopping in the Benelux and the US and to its Benelux supply chain; its online retailer bol was not affected. The chief executive, Frans Muller, said “most of the disruption was contained within two weeks”, and the investigation continues.[1] It has not named an attacker or mentioned a ransom. The refrigeration attacks that hit [Delhaize stores in Belgium on 2 November](https://www.thetechbag.com/blog/supermarket-freezers-hacked-second-wave-europe) are separate; the results documents do not mention them. What to watch: the full-year results on 17 February 2027, which will show the incident’s actual cost against this estimate.[6] How we did this Figures as of 6 November 2026, 7pm IST The estimates and guidance are Ahold Delhaize’s, from its 4 November release, interim report and prepared remarks; the incident timeline is from its three October statements. The ratios in the count box are our arithmetic on the company’s figures; we pair the ends of the two ranges both ways, which gives 30–50%. The company does not split the €200m cut in cash-flow guidance between the incident and Serbia, and neither do we. Spotted an error? Write to us; corrections are published at the foot of the piece. Sources 1. [Ahold Delhaize, Ahold Delhaize reports resilient Q3 2026 results and updates 2026 guidance to reflect business disruption caused by recent cybersecurity incident](https://newsroom.aholddelhaize.com/ahold-delhaize-reports-resilient-q3-2026-results-and-updates-2026-guidance-to-reflect-business-disruption-caused-by-recent-cybersecurity-incident/) — 4 November 2026 2. [Ahold Delhaize, Q3 2026 management prepared remarks (Frans Muller, Jolanda Poots-Bijl)](https://newsroom.aholddelhaize.com/download/43057f29-8819-4956-aad8-c1402a8e789a/aholddelhaizeq32026managementpreparedremarks.pdf) — 4 November 2026 3. [Ahold Delhaize, Ahold Delhaize takes precautionary measures following cybersecurity incident](https://newsroom.aholddelhaize.com/ahold-delhaize-takes-precautionary-measures-following-cybersecurity-incident/) — 12 October 2026 4. [Ahold Delhaize, Update on Ahold Delhaize's cybersecurity incident](https://newsroom.aholddelhaize.com/update-on-ahold-delhaizes-cybersecurity-incident/) — 13 October 2026 5. [Ahold Delhaize, Ahold Delhaize update on status of cybersecurity incident](https://newsroom.aholddelhaize.com/ahold-delhaize-update-on-status-of-cybersecurity-incident/) — 19 October 2026 6. [Ahold Delhaize, Interim report, third quarter 2026 (Note 13: subsequent events; financial calendar)](https://newsroom.aholddelhaize.com/download/4f6e8375-fb5c-47c7-9c10-429ac311709c/aholddelhaizeq32026interimreport.pdf) — 4 November 2026 **Disclosure.** TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view. Go deeper on TechBag - [Cyber recovery guide](https://www.thetechbag.com/browse/backup-cyber-resilience/cyber-recovery) — bringing systems back from a clean copy after an attack forces them offline - [Disaster recovery guide](https://www.thetechbag.com/browse/backup-cyber-resilience/disaster-recovery) — recovery-time targets for the sites, apps and supply systems a retailer runs on - [Managed detection and response guide](https://www.thetechbag.com/browse/security/managed-detection-response) — outside teams that detect suspicious activity early and help contain it