Ahold Delhaize Cyberattack: October Incident to Cut Q4 Sales by Up to €250 Million, and What It Shows About the Real Cost of Downtime

Ahold Delhaize, the grocery group behind Albert Heijn, Delhaize, Etos, Gall & Gall and the Ahold Delhaize USA brands, says an October cyberattack will cut its fourth-quarter sales by €200 million to €250 million, and it has lowered its 2026 outlook. If your business sells online or depends on a supply chain, this is a rare public price tag on a few weeks of disruption, and it shows that most of what a cyberattack costs is lost business, not the cleanup bill.

What happened in the Ahold Delhaize cyberattack

The timeline below comes from the company's own newsroom releases:

• Monday, October 12, 2026: Ahold Delhaize said it was "experiencing a security issue within its network" and was taking some systems offline to protect them. Stores stayed open.
• Tuesday, October 13: The company said it was working with external cybersecurity experts and had begun a controlled relaunch of some systems. It said there was no evidence at that moment that customer, associate or partner data had been taken.
• Monday, October 19: It confirmed that the suspicious activity in its IT infrastructure came from malicious actors. As a precaution it had taken systems offline, including brand websites and apps, which affected most of its brands in Europe and the United States. It said it notified the Dutch National Cyber Security Centre within 24 hours of finding the activity and filed a formal police report with Dutch police. By then Albert Heijn's website and app were back, with home deliveries expected to resume on Friday, October 23. Etos and Gall & Gall websites were available, e-commerce in Belgium was fully running, and e-commerce at the Ahold Delhaize USA brands was expected back "in the coming days."
• Wednesday, November 4: The company's third-quarter results put numbers on the damage.

How much the cyberattack cost Ahold Delhaize

These figures come from the November 4 results release. They are the company's own estimates, not final figures.

The free cash flow cut is not only the attack: the company also points to new supplier payment rules in Serbia. CEO Frans Muller said the incident "mainly affected our online capabilities in the Benelux and the U.S., as well as our Benelux supply-chain operations," and that most of the disruption was contained within two weeks. He added that work continues to fully restore normal operations. The company's online marketplace Bol was not affected.

What is confirmed and what is not known

Confirmed by Ahold Delhaize: malicious actors were active in its IT infrastructure. The company took websites, apps and other systems offline, stores stayed open, and Dutch authorities and police were told. Its sales and profit estimates are in the table above.

Not known:

• What kind of attack it was. The company has not said. None of its releases call it ransomware, so treat any report that does as unconfirmed.
• How the attackers got in. Nothing has been disclosed.
• Whether any data was taken. On October 19 the company said it had no evidence that sensitive customer, associate or partner data was taken, and that the investigation was ongoing. The November 4 release gives no update on data.
• Insurance. The results release does not say whether insurance will cover any of the loss.

This is not Ahold Delhaize's first incident. In an April 2025 release, the company said Ahold Delhaize USA had found a cybersecurity issue on its US network the previous November, and that it believed certain files were taken from some internal US business systems.

Why the cost of a cyberattack is mostly lost sales

Most of the cost here is downtime. The company calls its response and remediation costs marginal. The big numbers are lost sales and the profit that went with them: up to €250 million of sales and up to €100 million of operating income in one quarter.

Some of that loss was a choice. Ahold Delhaize took systems offline on purpose to protect them, and its CEO says the investigation confirmed this was the right call. That trade-off is the decision every business faces in the first hours of an attack: switch things off and lose sales now, or keep them running and risk a much worse outcome. Making that call well depends on knowing in advance what each system earns you per day and what else depends on it.

The parts of the business that went down were the online and connected ones: websites, apps, home delivery and supply-chain operations. The stores kept trading. For a company network, that means your website, online ordering, customer portal and links to suppliers are the parts most exposed to a shutdown. They are also the parts you may have to switch off yourself. If you have never priced a day without them, you cannot weigh that decision, set your cyber insurance limits or answer your board.

What to do this week: a downtime cost checklist

If you run your own servers or host your own online store, step 6 matters most. Our self-hosting infrastructure page covers how we set up backups and restores.

Ahold Delhaize cyberattack questions people are asking

Was the Ahold Delhaize cyberattack ransomware?

Not confirmed. Ahold Delhaize has not said what type of attack it was. It has confirmed only that malicious actors were active in its IT infrastructure.

Was customer data stolen in the Ahold Delhaize hack?

As of October 19 the company said it had no evidence that sensitive customer, associate or partner data was taken, and the investigation was ongoing. It has not given an update since.

How much did the Ahold Delhaize cyberattack cost?

The company estimates it will reduce fourth-quarter 2026 net sales by €200 million to €250 million and operating income by €75 million to €100 million. Response and remediation costs are expected to be marginal.

Which stores and brands were affected?

Stores stayed open. Websites and apps were taken offline for most brands in Europe and the United States, including Albert Heijn, Etos and Gall & Gall in the Netherlands, e-commerce in Belgium and the Ahold Delhaize USA brands. Bol was not affected.

Is Albert Heijn online ordering working again?

The company said on October 19 that Albert Heijn's website and app were back online, with home deliveries expected from October 23. On November 4 it said most of the disruption was contained within two weeks.

How do I estimate what a cyberattack would cost my business?

Start with lost sales, not the IT bill. Multiply your daily revenue for each channel by the days you could be offline, then add the profit on those sales, staff overtime and any contract penalties.

The bigger lesson

The cleanup was cheap for Ahold Delhaize. Losing its online channels and supply chain for a few weeks cost it up to €250 million in sales. Your security plan should be built around one number: what a day offline costs you, and how fast you can get back.

To cut that number down, see our security hardening work or get a quote.

Get security alerts like this by email, plus our free checklist, at security alerts.

Sources: Ahold Delhaize Q3 2026 results and guidance update; Ahold Delhaize update on status of cybersecurity incident; Ahold Delhaize precautionary measures statement; Update on Ahold Delhaize's cybersecurity incident.