Ahold Delhaize says the cyberattack that knocked out online services across its grocery brands in October will cut fourth-quarter net sales by €200 million to €250 million and reduce operating income by €75 million to €100 million. The company shared the estimate on November 4, 2026, with its third-quarter results, and lowered its 2026 outlook as a result.
The company has still not said what type of attack it was or who was behind it.
Timeline of the incident
Ahold Delhaize first disclosed on October 12, 2026, that it was experiencing a security issue within its network and had taken some systems offline. On October 19, it confirmed the activity was the result of the “malicious actions of others” and said it had filed a formal police report with the Dutch police. It said it notified the Dutch National Cyber Security Centre within 24 hours of discovering the activity and was providing updates to law enforcement and regulators.
To protect its environment, the company proactively took systems offline, including brand websites and apps. The impact varied by brand but touched most of its operations in Europe and the United States. Stores stayed open throughout. Albert Heijn’s website and app were back online by October 19, with home deliveries scheduled to resume from October 23, and e-commerce at its U.S. brands including Food Lion, Hannaford and Stop & Shop was restored around October 21.
Financial impact
In its third-quarter report, Ahold Delhaize said the incident, which occurred after the quarter closed, is expected to:
- Reduce Q4 net sales by €200 million to €250 million
- Reduce Q4 underlying and IFRS operating income by €75 million to €100 million
- Add incident response and remediation costs expected to have a marginal impact on 2026 IFRS operating income
The company now expects low-single-digit underlying earnings per share growth for 2026, down from its earlier mid- to high-single-digit forecast. Free cash flow is now expected to be around €2.1 billion instead of at least €2.3 billion. The company attributed part of that cut to the cyberattack and part to new Serbian rules on supplier payments.
What the company says about the attack
CEO Frans Muller said the company took some systems offline as part of its protocols, which “mainly affected our online capabilities in the Benelux and the U.S., as well as our Benelux supply-chain operations.” The Bol online marketplace was not affected. He added that most of the disruption was contained within two weeks, but work continues to fully restore normal operations.
In its October 19 statement, Ahold Delhaize said it had no evidence at that point that sensitive customer, associate or partner data had been taken, while stressing the investigation was ongoing. It declined to share further details that could compromise security measures. At the time of publication the company had not said whether the attack involved ransomware, whether a ransom was demanded, or whether any group had claimed responsibility.
A repeat target
This is not the first major incident for the retailer. In November 2024, a ransomware attack disrupted several of its U.S. brands, including Hannaford and Giant Food pharmacies. The INC Ransom group claimed responsibility, and Ahold Delhaize later disclosed that the personal information of more than 2.2 million people had been compromised, including financial, health and government ID details.
For related coverage of attacks on European grocers, see our report on cyberattacks on supermarket refrigeration systems.
