Ahold Delhaize Puts a Price on Its October Cyberattack: Up to €250 Million in Lost Sales

Up to €250 million in lost fourth-quarter sales is the price Ahold Delhaize now puts on the cybersecurity incident that forced it to take systems offline in October. The owner of Food Lion, Hannaford, Albert Heijn and Delhaize said in its third-quarter results Wednesday that the incident should cut Q4 net sales by €200 million to €250 million and underlying operating income by €75 million to €100 million.

That was enough to lower the 2026 outlook. The Zaandam-based grocer now expects diluted underlying earnings per share to grow at a low-single-digit rate at constant exchange rates, down from mid- to high-single digits, and free cash flow of around €2.1 billion instead of at least €2.3 billion. The cash flow cut also reflects new supplier payment regulations in Serbia. Response and remediation costs are expected to have only a “marginal impact” on 2026 IFRS operating income, the company said in its interim report.

Why the profit hit runs so deep

The operating income estimate is large next to the sales it accompanies. At the company’s ranges, it works out to between 30% and 50% of the lost revenue, while the group’s underlying operating margin in the third quarter was 4.1%. On the earnings call, CFO Jolanda Poots-Bijl listed what sits on top of the lost sales: shrink, “extra hours worked to get supply running,” “promotional actions to welcome customers back” and the loss of vendor allowances and retail media income, according to management’s prepared remarks.

The disruption mainly hit online ordering in the Benelux and the U.S. and the company’s Benelux supply chain, while its Bol marketplace was not affected. “While most of the disruption was contained within two weeks, work continues to fully restore our normal operations,” CEO Frans Muller said in the release.

When the company confirmed in October that the incident was a cyberattack, WebProNews reported that work had stopped at some Albert Heijn distribution centers and U.S. brands’ online services were still down a week later. This week also brought a separate suspected attack on refrigeration at supermarkets in Belgium, Luxembourg and Sweden, as WebProNews covered Monday.

The quarter before the outage

The third quarter itself, which closed before the attack, came in ahead of forecasts. Net sales were €23.1 billion, up 1.9% at constant rates, and diluted underlying EPS was €0.69. Analysts had expected €22.9 billion in sales and EPS of €0.65, Investing.com reported. U.S. online sales grew 14.2%, the tenth straight quarter of double-digit gains, and the company kept its plan for a €1 billion share buyback in 2027.

Muller told analysts the company is “taking the lessons seriously” and working to emerge better prepared. Neither the release nor the prepared remarks say what kind of attack it was or who was behind it. The investigation, Muller said, “remains ongoing.”