Ahold Delhaize, the Dutch-Belgian supermarket group behind Albert Heijn, Food Lion and Stop & Shop, has put a number on its October disruption. The Ahold Delhaize cyberattack is now priced at up to €250 million in lost fourth-quarter sales, by the company’s own 4 November 2026 estimate.
These figures come from the company’s own newsroom release and interim report, not a reconstruction by anyone else. Ahold Delhaize gives no single total-cost figure beyond the ranges below.
What Happened, in Ahold Delhaize’s Own Words?
The company says a cybersecurity incident affected its business in October 2026. As part of its own protocols, it took some systems offline to protect its IT environment. To differing degrees, this mainly affected online capabilities in the Benelux region and the United States, plus Benelux supply-chain operations. The company states that its online marketplace, Bol, was not impacted.
President and CEO Frans Muller said most of the disruption was contained within two weeks, though work continued to fully restore normal operations as of 4 November 2026. He thanked colleagues, partners, authorities and peers for their help in the response.
How Much Did the Ahold Delhaize Cyberattack Cost?
The company’s Q3 2026 interim report assigns two ranges to the fourth quarter. Net sales are expected to fall by €200 million to €250 million. Underlying and IFRS operating income are expected to fall by €75 million to €100 million. Ahold Delhaize adds that incremental response and remediation costs are expected to have a marginal impact on 2026 IFRS operating income, with no separate figure given for that cost.
- Q4 net sales impact.
- €200 million to €250 million lower, by the company’s own current estimation.
- Q4 operating income impact.
- €75 million to €100 million lower, both underlying and IFRS.
- Response and remediation costs.
- a marginal impact on 2026 IFRS operating income, no separate figure given.
- Systems affected.
- online capabilities in the Benelux region and the United States, and Benelux supply-chain operations.
- Bol.
- stated as not impacted.
- Disruption window.
- most contained within two weeks; full restoration still under way as of 4 November 2026.
These ranges sit inside a much larger business. Group net sales for the third quarter alone were €23.1 billion, up 1.9 percent at constant exchange rates, with an underlying operating margin of 4.1 percent.
How Did the Cyberattack Change Ahold Delhaize’s 2026 Guidance?
The company lowered three full-year targets at the same time it published the incident’s cost. It also names a second, separate cause for part of the change: new supplier payment rules in Serbia, which affect free cash flow alongside the cyberattack.
| Metric | Previous guidance | Updated guidance |
|---|---|---|
| Underlying operating margin | Around 4.0 percent | Approaching 4.0 percent |
| Diluted underlying EPS growth | Mid to high single digit | Low single digit |
| Free cash flow | At least €2.3 billion | Around €2.1 billion |
Ahold Delhaize still confirmed a €1 billion share buyback program to start in 2027. It also said it aims to grow its dividend per share for 2026 at a mid-single-digit rate. The company frames the incident as a cost to one quarter, not a change to its wider strategy.
What Does Ahold Delhaize’s Own Disclosure Leave Out?
The press release and interim report name no cause for the incident. They do not use the word ransomware to describe it. That word appears only in the filing’s standing list of general risk factors, a list the company discloses every quarter regardless of events.
The company says it engaged relevant authorities and other stakeholders as appropriate, without naming which ones. Beyond the two Q4 ranges above, the disclosure gives no total-cost figure, insurance-recovery figure or restoration-completion date, as of 4 November 2026.
What Else Did Ahold Delhaize Announce the Same Week?
The company’s business did not pause around the incident. On 30 October 2026, days before it published the cyberattack’s cost, Ahold Delhaize announced an agreement to acquire 100 percent of Tesco’s operations in Czechia and Slovakia.
The deal carries an enterprise value of about €1.2 billion, or €1.7 billion on a lease-adjusted basis, funded from committed financing and existing resources. The company expects it to close in 2027, once regulatory clearances are granted. Ahold Delhaize’s own materials present the acquisition and the cyberattack disclosure as separate matters, one about growth and one about recovery.
What Should Retail and Grocery Security Teams Take From This?
Few companies put a number on a cyberattack’s cost before investors ask for one. Ahold Delhaize’s own range gives other retailers a benchmark for the kind of business-interruption figure a board or an insurer wants after a similar incident.
- Model the business-interruption number nowWork out, in advance, what a two-week outage of online ordering and supply-chain systems would cost your own business, using your own sales data.
- Separate digital brands from core operationsAhold Delhaize says its separate online marketplace, Bol, was not impacted. Check whether your own separately run digital properties share infrastructure with the systems you would take offline first.
- Rehearse the systems-offline decisionKnow in advance which systems a response team can safely take offline, and for how long, before a real incident forces the choice.
- Prepare investor-facing numbers earlyIf your company reports earnings, agree with finance and legal in advance how a cyberattack’s cost would be estimated and disclosed.
For the wider pattern, see our supermarket refrigeration cyberattack playbook and our note on cyber disclosure rules. Our incident response plan glossary entry covers the planning work behind the steps above.
Method
Every figure above comes from Ahold Delhaize’s own 4 November 2026 newsroom release and its Q3 2026 interim report, Note 13: Subsequent events. They are the company’s own current estimations and may change as its review continues.