Cyberattack costs Albert Heijn's parent company up to €250 million in sales

Ahold Delhaize, the parent company of Albert Heijn, expects October’s cyberattack to cost €200–250 million in sales and €75–100 million in operating income in the fourth quarter. The figures are in its results of 4 November. For Dutch boards, it shows how quickly an IT incident can reach the entire business.

What happened?

News of major disruption broke on 12 October. Ahold Delhaize took systems offline to protect its IT environment. This mainly affected online services in the Benelux and the US and the Benelux supply chain; bol was not affected.

Distribution centres came to a standstill, stores faced empty shelves, and websites and apps were unavailable for days. CEO Frans Muller says most of the disruption was contained within two weeks, but that work to fully restore normal operations continues.

What will the attack cost?

• Sales: €200–250 million lower in the fourth quarter.
• Operating income: €75–100 million lower. Response and remediation costs come on top, but the company expects only a marginal effect on its 2026 result.

How did the stock market respond?

After the first news, the share price lost nearly 3%. On 13 October it was still about 2.5% below the previous Friday’s close.

On the day of the quarterly results the shares rose: ANP reported a gain of just over 2% that morning. Third-quarter results beat expectations. The estimated damage was also below the forecast of Degroof Petercam, which only a day earlier was still expecting €600 million in lost sales and €150 million less in profit.

Is there a link with the hacked refrigeration systems?

None has been established, but the series of incidents does show how exposed the sector is. On the same day Albert Heijn was hit (12 October), NOS reported that hackers had tampered with the refrigeration systems of hundreds of French stores. An Ahold Delhaize spokesperson saw no reason to link this to the company’s own incident.

New attacks followed in several European countries in early November. In Belgium, at least 76 stores were hit, around forty of them Delhaize. In the Netherlands, at least seventeen businesses were affected, such as neighbourhood shops and butchers. Their systems lacked an adequately secured network connection and still used default passwords. Who is behind the attacks has not been confirmed.

What does this mean for your organisation?

The lesson goes beyond supermarkets. Put four questions to your board:

• How long can your organisation keep running if you have to take core systems offline yourself, and what does each day of downtime cost?
• Do you know what your core processes are and what they depend on?
• Are operational systems, such as refrigeration, building management and logistics, shielded from the internet and protected with their own passwords?
• Has the decision to take systems offline been assigned and rehearsed in advance?

Want to prepare your board? See our NIS2 boardroom training or read more about digital resilience.