Ahold Delhaize, the Dutch-Belgian owner of U.S. grocery chains including Food Lion, Stop & Shop, Hannaford and Giant, expects the cyberattack that forced it to take systems offline in October to reduce fourth-quarter net sales by €200 million to €250 million, SecurityWeek reported Friday. The estimate, paired with a cut to the company's 2026 outlook, gives boards an unusually concrete measure of what a roughly two-week cyber disruption costs a large retailer.
What Happened
In its third-quarter results statement Nov. 4, Ahold Delhaize said the incident would also reduce fourth-quarter operating income by €75 million to €100 million, both on an underlying basis and under International Financial Reporting Standards. SecurityWeek put the sales hit at about $224 million to $280 million. The company expects the extra cost of responding to and repairing the damage to have only a marginal effect on 2026 operating income.
The company lowered its full-year guidance. It now expects growth in diluted underlying earnings per share, at constant exchange rates, in the low single digits, down from mid to high single digits. It cut its free cash flow forecast to about €2.1 billion from at least €2.3 billion, a reduction it attributed both to the attack and to new supplier-payment rules in Serbia. Its dividend growth target and a planned €1 billion share buyback starting in 2027 were left unchanged.
According to the statement, the systems Ahold Delhaize took offline as a precaution mainly affected online services in the Benelux countries and the U.S., along with supply-chain operations in the Benelux. Most of the disruption was contained within about two weeks, but work to fully restore normal operations continues, and its brands are offering promotions to returning customers. "We apologize to our brands' customers for the disruption and inconvenience this caused," Chief Executive Frans Muller said in the statement.
Why It Matters
By the company's own estimate, response and repair costs are marginal next to the business lost while systems were deliberately shut down. Isolating a network to stop an intruder is standard practice, yet for a retailer it can halt online ordering and deliveries at once. The Primary Wire reported Oct. 13, citing The Record, that the shutdown disrupted online ordering, deliveries and in-store pricing.
For directors, the disclosure offers a benchmark for testing business-interruption insurance limits and resilience budgets against a realistic scenario. For scale, Ahold Delhaize reported third-quarter net sales of €23.1 billion.
Context
This is the company's second major cyber incident in two years. A November 2024 ransomware attack, claimed by the INC Ransom group, disrupted U.S. brands including Hannaford and Giant Food pharmacies, and the company later disclosed that personal information of more than 2.2 million people was compromised, SecurityWeek reported.
What to Watch
Key facts are still undisclosed: what kind of attack it was, who carried it out and whether a ransom was demanded. On Oct. 19, the company said it had no evidence at that point that customer, associate or partner data had been stolen, as The Primary Wire reported at the time. The Nov. 4 statement does not address data theft.
Signals to watch include whether any breach notices reach U.S. state regulators, when the company declares operations fully restored, and how closely its fourth-quarter results match the estimate.
