On Sunday 11 October 2026, Ahold Delhaize detected suspicious activity in its IT infrastructure. By Monday, it had taken systems offline across both continents it operates on, saying it was "taking some systems offline to help protect them".
The group runs 9,551 stores, employs 384,000 people and serves around 77 million customers a week. Its brands include Albert Heijn in the Netherlands, Delhaize in Belgium, Etos, Gall & Gall, bol.com, and in the United States Food Lion, Stop & Shop, Hannaford, Giant Food, The GIANT Company and Martin's.
For the next week and a half, online ordering, home delivery, mobile apps, loyalty programmes and digital coupons were unavailable. Distribution centres stopped. Electronic shelf labels in some stores kept displaying the previous week's promotions. Every supermarket stayed open.
Two numbers are circulating and they measure different things. Retail experts estimate Albert Heijn alone missed €120 million to €150 million in revenue across the disruption, a figure later widened by some to €100 to €200 million. Separately, unnamed sector sources told the Dutch financial daily Het Financieele Dagblad that the crisis was costing Ahold Delhaize tens of millions of euros a day group-wide.
Ahold Delhaize itself has published no figure. Its third-quarter results are due on 4 November.
What happened
Timeline
When | What |
|---|---|
Sunday 11 October | Suspicious activity detected, Albert Heijn begins switching off parts of its IT infrastructure |
Monday 12 October | Group announces a "security issue within its network", systems taken offline, all stores remain open |
12 to 14 October | Distribution centres at a standstill, home deliveries cancelled, fresh produce sections emptying, websites of at least eight chains offline |
13 October | Company begins a controlled relaunch of certain systems |
18 October | Albert Heijn website and app back online |
20 October | US e-commerce restored across Food Lion, The GIANT Company, Giant Food, Hannaford and Stop & Shop |
Around 19 to 20 October | Ahold Delhaize files a police report, roughly a week after the incident |
22 October | Belgian e-commerce fully operational |
23 October | Albert Heijn home deliveries resume, eleven days after they stopped |
Late October | Dutch police open a criminal investigation |
What the company has confirmed
Ahold Delhaize's own investigation established that the suspicious activity was the result of malicious actions by third parties. The company has stated it has no indication that sensitive data belonging to customers, employees or partners was taken.
It has not said what kind of attack it was, who was responsible, or how the intruders got in.
An early hypothesis circulated that this might have been a distributed denial-of-service attack rather than an intrusion. Cor Molenaar, emeritus professor of e-marketing at Erasmus University Rotterdam, suggested as much in the first days. The company's later confirmation of malicious third-party actions does not settle the question either way, and no technical detail has been published.
Where the money figures come from
This deserves care, because the numbers are being reported loosely.
The €120 to €150 million range comes from two retail experts who produced calculations at the request of Dutch broadcaster RTL Z. It covers Albert Heijn only, and it covers the whole disruption, not a single week.
Laurens Sloot, professor of Entrepreneurship and Retail at the University of Groningen, estimates Albert Heijn normally takes about €360 million a week in stores. He puts the first-week loss at 20 to 25 percent of that, roughly €70 to €90 million. Online sales, normally about €40 million a week, dropped to zero, with a further €20 million expected to be missed as deliveries restarted. Total: around €150 million. His assessment of the scale was direct: "Even for Albert Heijn, that's a substantial amount."
Erik Hemmes, a supermarket expert, works from a normal total of about €380 million a week and estimates in-store revenue ran about 10 percent lower for a week and a half, arriving at roughly €120 million.
Both describe their in-store figures as rough estimates, partly inferred from reports of extra trade at competing supermarkets.
Earlier in the incident the estimates were far lower. On 14 October, Molenaar put the damage at around €10 million, warning the losses could grow quickly, while Hemmes calculated about €21 million missed by that point. The figures rose as the outage continued, which is itself the clearest illustration of how downtime costs compound.
Europe recovered faster than America
The recovery timeline split cleanly by continent. Belgian e-commerce was fully restored and Albert Heijn's website and app returned on 18 October, while US brands waited until 20 October with no specific date given to customers beforehand.
One structural explanation offered is that the US estate was assembled through decades of separate acquisitions. Food Lion, Giant Food, Martin's, Hannaford and Stop & Shop all entered the group through distinct corporate histories, leaving a more fragmented IT environment that is harder to restore uniformly than a European stack built around Albert Heijn's home-market systems.
Not the first time
In November 2024, Ahold Delhaize suffered a separate incident, later claimed by the INC Ransom group, affecting business systems operated by Ahold Delhaize USA Services. The company disclosed in 2025 that it affected more than two million people.
A note on a parallel story
This incident coincided with the attack on refrigeration controllers at hundreds of French supermarkets. Ahold Delhaize has stated there is no connection between the two. They are separate events in the same fortnight, and conflating them is a mistake several outlets have made.
Why it matters
Physical resilience and digital resilience are not the same thing, and most retailers only have one. Every store stayed open throughout. Tills worked, shelves were stocked, staff turned up. And the group still lost an estimated nine-figure sum, because a growing share of grocery revenue no longer passes through a physical checkout.
The cost is non-linear. On 14 October, the estimate was €10 million. Ten days later it was €120 to €150 million for one brand. Downtime costs do not accumulate steadily, they accelerate, because customers who cannot order once will order elsewhere, and some do not come back.
Precautionary shutdown is a business decision with a price tag. Taking systems offline was the right call for containment. It was also the direct cause of most of the loss. That trade-off is made under pressure, usually without anyone having calculated in advance what an hour of e-commerce downtime costs.
Recovery speed depends on architecture decided years earlier. The gap between the Belgian and US recovery timelines was not about incident response quality. It reflects how fragmented an IT estate assembled through acquisitions becomes, and how hard that makes a uniform restore.
Loyalty data is operational, not just marketing. Personal discounts and app-linked savings were suspended. Customers were advised to keep receipts so missed loyalty stamps could be bought later. The systems a retailer treats as marketing infrastructure turn out to be part of the customer transaction.
Who is affected
Customers across eleven brands in the Netherlands, Belgium and the United States, who lost online ordering, delivery, apps, digital coupons and loyalty benefits for up to eleven days.
Online grocery customers specifically, including people who rely on delivery rather than choosing it for convenience.
384,000 employees, with reporting indicating employee scheduling systems were also affected.
Suppliers, through halted distribution centres and interrupted replenishment.
Shareholders, with the financial impact still unquantified publicly ahead of results on 4 November.
What organisations should do
Know what downtime costs before you have to decide
Calculate the hourly cost of each digital channel going offline, by channel and by region. The decision to take systems down happens in minutes. The arithmetic should already exist.
Define in advance who can authorise a precautionary shutdown, and at what threshold. This should not be improvised during an incident.
Build for degraded operation
Ensure physical operations can run without head-office systems. Ahold Delhaize's stores stayed open, which limited the damage enormously. Verify that yours could, including pricing, payment and replenishment.
Keep an offline pricing fallback. Electronic shelf labels displaying last week's promotions is a small detail with real legal and customer-trust consequences.
Plan manual processes for returns, loyalty and refunds, which is where customer anger concentrates when systems fail.
Address fragmentation before it becomes a recovery problem
Map which parts of your estate can be restored independently. Acquisitions leave behind systems that recover at different speeds, and you will discover which during an incident unless you check first.
Segment by brand, region and business unit so that an incident in one does not require shutting down all.
Communications
Give customers specific, repeated updates. Ahold Delhaize told US customers service would return "in the coming days" without a date, which is the hardest message for customers to act on.
Say what you know and what you do not. The company waited more than a week to file a police report and still has not described the attack, which leaves speculation to fill the gap.
Afterwards
Expect the estimate to rise. Early damage figures in a live incident are almost always low, because nobody yet knows how long the outage will run.
Treat a second incident as likely. This is the group's second major cyber event in under two years.
Final thoughts
The most striking image from this incident is also the most ordinary. Shoppers walked into Albert Heijn and Stop & Shop and bought groceries, exactly as they always had, while the company behind those shops was running an eleven-day digital blackout across two continents.
The lesson: a retailer can be fully operational and still be losing a nine-figure sum, because the part of the business that generates the most fragile revenue is the part that nobody can see from the shop floor. Online is roughly a tenth of Albert Heijn's business, and switching it off accounted for a large share of a loss estimated at up to €150 million. Physical resilience hid the failure without preventing the cost.
The second lesson is about the shape of the damage. The first expert estimate, four days in, was €10 million. The figure that stuck, ten days later, was fifteen times higher. Incident cost is a function of duration, and duration is a function of how quickly you can restore systems that in most large organisations, were never designed to be restored quickly. The Belgian business came back before the American one for reasons that had nothing to do with the attack and everything to do with how the company was built.
Two questions worth answering before you need them: what does one hour of your e-commerce channel being offline actually cost, and could your physical operations trade for a week without head office?
