Ahold Delhaize puts October cyberattack cost at up to €250 million in lost sales

Ahold Delhaize has put a number on October's cyberattack. The Dutch-Belgian grocery group, whose brands include Albert Heijn, Delhaize, Food Lion and Hannaford, says the incident will wipe €200 million to €250 million off fourth-quarter net sales, and €75 million to €100 million off fourth-quarter operating income. The estimate came with its third-quarter results; the attack happened after the quarter closed.

The retailer has also cut its 2026 outlook. Diluted underlying earnings per share at constant exchange rates are now expected to grow in the low single digits, down from the mid to high single digits it had forecast. Free cash flow is put at around €2.1 billion rather than at least €2.3 billion, a reduction it attributes to the attack and to new Serbian rules on supplier payments.

CEO Frans Muller said systems were taken offline to protect the IT environment, mainly affecting online capabilities in the Benelux and the US, plus Benelux supply-chain operations. Most of the disruption was contained within two weeks, he said, though restoration work continues.

What kind of attack it was, the company hasn't disclosed. When it confirmed the incident on October 19, it said it had no evidence at the time that customer, associate or partner data had been stolen.

The company has been here before. A ransomware attack in November 2024 hit US brands including Hannaford and Giant Food pharmacies; the INC Ransom group claimed it, and Ahold Delhaize later said the personal information of more than 2.2 million people had been compromised.

For defenders, the useful detail is the shape of the loss: sales lost to systems taken offline, not a ransom figure. Nobody outside the company can yet say whether the two events are connected.