Ahold Delhaize expects to lose between €200 million and €250 million in sales in the fourth quarter following the cyberattack that disrupted its operations in October. Announced on 4 November, the estimate measures the group’s lost commercial revenue after some of its ordering and logistics operations were interrupted. The return to normal operations was still under way at that point.
For the retailer, the challenge goes beyond getting its IT systems back online: it must regain the ability to take orders, supply stores and serve customers. In food retail, these operations are closely linked, even when stores remain open.
Systems taken offline to protect the network
In its statement of 13 October, updated on 14 October, Ahold Delhaize said it had taken some systems offline as a precaution after discovering a cybersecurity incident. This protective measure had itself caused disruption for customers, employees and partners.
The group said at the time that it was carrying out a controlled restart of some systems, with support from external specialists and in coordination with the relevant authorities. Its stores in Europe and the United States remained open, but the effects varied between brands.
This timeline highlights one challenge of recovery: bringing a service back online also means ensuring that restoring it does not compromise network security. Stores reopening and all their functions being restored therefore do not necessarily follow the same timetable.
Orders and supply affected
The update published on 4 November specifies the activities mainly affected: online sales in the Benelux and the United States, as well as the supply chain in the Benelux. Bol was not affected by the incident, the group said.
According to the group’s management, most of the disruption was contained within two weeks. However, the full restoration of operations was still under way when the announcement was made.
An interruption to order-taking can prevent a sale; a logistics problem can delay product availability. These are two ways an IT incident can affect business, without requiring a general closure of stores. The group’s communications do not, however, break down lost revenue by brand or country.
An effect on sales and earnings
Ahold Delhaize estimates that its net sales in the fourth quarter will be reduced by €200 million to €250 million. The estimated impact on operating income is €75 million to €100 million, for both the underlying and reported measures. Response and recovery costs will be added to this; the group expects these to have a marginal impact on its annual reported operating income.
Revenue and earnings measure different things: the former represents sales, while the latter takes account of operating costs. The two estimates should therefore not be added together to calculate a total bill. They are also forecasts, as the quarter is still under way.
On the ground, restoring services should enable customers to return to their usual shopping habits. Financially, the next results will make it possible to compare the actual lost revenue with the estimate announced.
Four Luxembourg stores affected by a separate incident
In Luxembourg, a separate incident was reported in early November: refrigeration equipment was targeted during the night of 1 to 2 November. Delhaize told RTL Infos that four of its stores in the country had been affected, without specifying which ones. The retailer said it had taken the necessary measures to keep them operating and preserve the freshness of products.
The cited sources establish no link between this incident and the October intrusion. The group’s financial estimate relates to the October incident; no figure specific to the Luxembourg stores has been disclosed in these documents.
The technical investigation remains a separate aspect of the case
In its update of 13–14 October, Ahold Delhaize said it had, at that stage, no evidence that customer, employee or partner data had been stolen. This was not a definitive conclusion of the investigation. The group limited the details it made public in order not to compromise its response to the incident.
The commercial impact is thus more clearly quantified than the information available about the intrusion itself. For the retailer’s customers and partners, the two developments to watch are the full restoration of operations and any further findings about the data involved.
File photo: Delhaize store in Épinois, Belgium, in November 2024. Le Sharkoïste / Wikimedia Commons / CC BY 4.0.
