The facts
Ahold Delhaize estimates its October cybersecurity incident will reduce Q4 net sales by €200 million to €250 million and underlying and IFRS operating income by €75 million to €100 million; it says incremental response and remediation costs should have a marginal 2026 IFRS effect. [1]
The company lowered its full-year 2026 expectation for underlying diluted EPS growth at constant exchange rates from mid- to high-single digits to low-single digits and reduced its free-cash-flow outlook from at least €2.3 billion to around €2.1 billion. It attributed the changes to the incident and new Serbian supplier-payment regulations. [1]
Ahold Delhaize reported Q3 net sales of €23.089 billion, up 1.9% at constant exchange rates, and underlying operating income of €946 million; the cyber incident estimate concerns Q4, not the completed quarter. [1]
The company said the October incident mainly affected online capabilities in the Benelux and United States and Benelux supply-chain operations; it said the majority of affected operations had been restored and bol.com was not affected. [1]
NL Times reported that several Dutch brands’ websites, apps and loyalty programmes failed and that Albert Heijn could not deliver online or restock some shelves for nearly two weeks; it also reported the company’s estimate that most disruption was contained within two weeks. [2]
Still unconfirmed
- The intrusion method, actor, whether any data were accessed or exfiltrated, and any ransom demand were not disclosed in the sources reviewed.
- The exact set of affected U.S. services and remaining restoration work were not specified; the company said most affected operations had been restored.
- The company’s €200–250 million sales and €75–100 million operating-income impacts are estimates, not realized final losses.
Sources
References support the numbered facts above. Source checks: 4 Nov 2026, 12:15 UTC.
The company’s primary results release establishes its own incident assessment, estimated financial impact and outlook change. NL Times reports local service effects and likewise attributes the financial estimates to the company. No independent forensic account or evidence of data theft was available; those details are explicitly unknown.
- Ahold Delhaize reports resilient Q3 2026 results and updates 2026 guidance to reflect business disruption caused by recent cybersecurity incident
Ahold Delhaize · Primary source · 4 Nov 2026
Opened the company’s Q3 release and interim report. It gives the cyber-impact estimates, revised outlook, quarterly results and says the October incident mainly affected online capabilities in the Benelux and US plus Benelux supply-chain operations.
- Cyberattack cost Albert Heijn parent Ahold Delhaize estimated €250 million
NL Times · Reporting · 4 Nov 2026
Opened the local report. It adds the Netherlands brand/service impacts and attributes the estimates to the company’s Q3 release and CEO; it does not provide independent forensic findings.