Ahold Delhaize is likely to get through its October cyberattack without cutting its 2026 outlook. Three signals point the same way. The company is likely to reiterate its guidance when it reports third quarter results on November 4, 2026. It is also likely to put a euro figure on the incident by its fourth quarter results in February 2027, at a base case of €40–120 million in profit impact, with most of the direct cost presented outside underlying operating income.
The prior precedent from Marks & Spencer, the Co-op and UNFI points to a real but bounded bill. Ahold’s own calendar, a 14-week fourth quarter and a CEO handover on March 3, 2027, shapes how and when that bill gets shown.
In short
- The prediction: Ahold Delhaize likely reiterates its 2026 outlook on November 4 (underlying operating margin of around 4%, mid- to high-single-digit underlying EPS growth, free cash flow of at least €2.3 billion), and puts a euro figure on the cyber incident by its Q4 2026 results in February 2027.
- The base case cost: €40–120 million of total profit impact (lost online sales margin plus response and recovery costs), with the one-off portion most likely excluded from underlying operating income.
- Signal 1: the outage was digital, not physical. Stores stayed open in every market while websites and apps went dark for roughly eight days in the US and about eleven days for Albert Heijn home delivery.
- Signal 2: the calendar. Q3 closed on September 27, so the incident falls entirely inside a 14-week Q4 that also carries the 53rd week, and the full-year results will be the last ones under Frans Muller before Thierry Garnier takes over on March 3, 2027.
- Signal 3: the buyback never stopped. Ahold repurchased €12.8 million of shares during the week of the attack, at an average price of €31.97, versus €31.88 the week before, which suggests neither the company nor the market treated the incident as a balance-sheet event.
Why this matters now
On Monday, October 12, 2026, Ahold Delhaize disclosed a “security issue within its network” and took systems offline. The release was flagged as inside information under the EU Market Abuse Regulation, which tells you the company judged it potentially price-sensitive from the first hour. By October 19 the company confirmed the activity “resulted from the malicious actions of others” and that it had filed a formal report with the Dutch police.
The disruption reached most of the group. Websites and apps went offline for Stop & Shop, Food Lion, Giant Food, The Giant Company and Hannaford in the US, and for Albert Heijn, Etos, Gall & Gall and several Central and Southeastern European brands. Trade press reported that US e-commerce came back around October 20 and 21, roughly eight days after the shutdown. Albert Heijn said home deliveries would resume from Friday, October 23.
This lands at a sensitive moment for the US business, which was already carrying the weight of price investment. In Q2, US comparable sales excluding gasoline grew only 0.8%, while online sales grew 14.5% at constant rates, the ninth straight quarter of double-digit online growth. E-commerce is the part of the American story investors were rewarding, and that is exactly what went dark. We flagged earlier this year that US grocery is heading for a price-and-tech reset; this incident tests the technology half of that reset in public.
The question for retailers, suppliers and investors is not whether the attack cost money. It did. The question is whether it changes the guidance, the capital return and the strategic agenda the incoming CEO inherits. The signals suggest it likely does not change the first two, and that the third gets reframed rather than rewritten.
Signal 1: an eight-day digital blackout that spared the stores
The most important fact in Ahold’s October 19 update is a single sentence: “All stores across all brands have remained open throughout the incident.” That separates this event from the British retail attacks of 2025, where store replenishment, stock availability and back-office systems were hit as well. Ahold’s description is of a precautionary shutdown of customer-facing digital channels, followed by a “phased restoration of our systems and services to support the distribution of groceries.”
The company’s own wording also matters for the cost estimate. It said the decision to take systems offline “affected most of our brands across Europe and the United States, although the impact varied by brand.” It also said it had “no evidence at this moment that suggests that any sensitive customer, associate or partner data was taken.” If that holds, the regulatory and litigation tail that drove costs at other breached retailers is much thinner here.
Sizing the revenue at risk
Ahold’s Q2 interim report gives a clean base for estimating exposure. US online sales were €1,254 million in the 13-week quarter, or roughly €96 million a week. An outage of about eight days therefore put something like €110 million of gross US online sales at risk. European online sales were €1,412 million in Q2, about €109 million a week, but that figure includes bol, and the company’s updates did not single bol out as affected, so the European exposure is harder to pin down.
Not all of that revenue is lost. Stores stayed open, so a share of online baskets almost certainly moved in-store, at a different and often better margin for the retailer. The real loss is the share of customers who shopped at a rival during the outage, plus any who do not come back. A reasonable working assumption is that gross online sales of €150–250 million were offline across the group, and that net lost sales were materially lower once in-store substitution is counted.
What the restoration order tells us
The sequence of recovery is itself informative. Belgium was “fully operational” in e-commerce by October 19, most Central and Southeastern European sites were back, and Albert Heijn’s website and app were online with deliveries following a few days later. The US banners came back last. That order suggests the shared US technology backbone, which the company described in August as being modernized, took the longest to clear.
A staggered, brand-by-brand restoration is also what a contained incident looks like. A company facing encrypted core systems would usually describe store or supply disruption, delayed payroll or manual workarounds at the till. None of that appears in Ahold’s updates, and stores trading normally for the whole period is consistent with point-of-sale and replenishment systems that were either untouched or restored quickly.
Why this points to a bounded bill
Ahold’s group underlying operating income runs at about €3.7–3.8 billion a year at its guided margin of around 4%. A total profit impact of €40–120 million would be roughly 1–3% of that, or about 0.04–0.13 percentage points of margin. That fits inside the tolerance of a guidance range phrased as “around 4%,” which is why the outlook likely survives the incident even if the incident is clearly visible in the fourth quarter.
Ahold’s own status updates are the best primary record; the company’s October 19 update on the incident sets out the restoration sequence by region.
Signal 2: a calendar that pushes the bill into Q4 and a CEO handover
Ahold’s 2026 financial year runs on a 4/4/5-week calendar with four 13-week quarters, except for the last quarter, which has 14 weeks because 2026 is a 53-week year. Q2 ended on June 28, 2026, which puts the end of Q3 on September 27. The incident started on October 12, so none of it falls in the quarter being reported on November 4.
That timing has two consequences. First, the Q3 numbers will be clean, and the November 4 call becomes a forward-looking exercise: management has to say whether the outlook holds, without a quarter of data that shows the damage. Second, the damage lands in a quarter that is mechanically inflated by an extra week. The Q2 report said the 53rd week would add 1.5–2% to full-year net sales and around 2–3% to underlying income from continuing operations.
The 53rd week cushions the headline
An extra week of trading in Q4 adds roughly 7–8% to that quarter’s raw sales relative to a 13-week comparison base. An outage that took out about one week of US online sales is therefore likely to be partly hidden in reported Q4 online growth. That is a reason to expect the company to quantify the incident separately rather than let it disappear in the numbers: analysts will ask how much of the Q4 online figure is the extra week and how much is lost trade.
The CEO handover sets the deadline
The second calendar fact is the succession. On October 21, nine days after the attack began, Ahold announced that Thierry Garnier will join on January 11, 2027 as EVP and become President and CEO at close of business on March 3, 2027. Frans Muller “will remain fully responsible for leading the company until that date.” The full-year 2026 results, which on Ahold’s usual calendar arrive in February, will therefore be Muller’s last as CEO.
The prior precedent points to outgoing chiefs closing their books cleanly before a handover, so the successor does not inherit an open-ended issue. A quantified, ring-fenced incident cost reported in February would let Garnier start on March 3 with the cyber event already in the base year. We argued in August that retail’s 2026 CEO class likely resets targets by March 2027; Ahold’s handover sits right on that line, but the reset is more likely to come at a later strategy update under Garnier than in the February numbers.
The October 13 extraordinary general meeting adds a quieter detail. Shareholders appointed Edmond Mesrobian, described by the chair as an “experienced technology and digital leader,” to the Supervisory Board on the day after the incident began. The nomination predates the attack, so it is not a response to it, but it does mean the board has fresh technology oversight in place as the post-incident review gets underway.
Signal 3: the buyback kept running through the outage
The cleanest market signal comes from Ahold’s weekly share buyback disclosures. On October 20, the company reported that it had repurchased 399,629 shares between October 12 and October 16, the first week of the incident, at an average price of €31.97, for €12.8 million. The prior week, October 5 to 9, it bought 409,341 shares at an average of €31.88.
Two things follow. First, the company did not suspend the program, which it could have done if it believed it held undisclosed material information about the cost of the attack. Second, the average purchase price barely moved, which suggests the market priced the event as an operational nuisance rather than a structural problem. Both are consistent with a guidance hold.
| Week (2026) | Shares repurchased | Average price | Consideration | Program total to date |
|---|---|---|---|---|
| Sep 21–25 | 409,600 | €31.81 | €13.0m | €849.6m |
| Sep 28–Oct 2 | 406,632 | €31.92 | €13.0m | €862.6m |
| Oct 5–9 | 409,341 | €31.88 | €13.0m | €875.6m |
| Oct 12–16 (incident week) | 399,629 | €31.97 | €12.8m | €888.4m |
Source: Ahold Delhaize weekly share buyback updates, September 29 to October 20, 2026.
The next program is due on the same calendar
The current €1 billion program was announced on November 5, 2025, alongside Q3 2025 results. At €888.4 million spent by October 16 and a pace of about €13 million a week, the remaining €111.6 million runs out in roughly eight to nine weeks, which is mid- to late December. That makes November 4 the natural date to announce a 2027 program, exactly as last year.
Signals point to a renewal of around €1 billion. A smaller program, or a delay to February, would be the clearest early sign that management sees a larger cost than the market does. Either way, the November 4 release gives a falsifiable first read on this call.
What the pattern suggests
Taken together, the three signals describe a company that treats the incident as a fourth-quarter cost, not a change to its earnings power. The outage hit channels, not stores. The calendar puts the whole event in one quarter that is padded by an extra week. And the capital return program, the most sensitive indicator of management confidence, kept running at the same pace and the same price.
The most likely sequence is therefore a reiteration on November 4, with a qualitative description of the incident and perhaps a preliminary range, followed by a quantified figure in February. The prior precedent suggests the direct costs (forensics, recovery, legal and advisory) get presented as a one-off, while lost sales margin flows through the underlying numbers and gets explained on the call.
| Signal | Observed (date) | Source type | What it implies | Weight |
|---|---|---|---|---|
| Stores open, digital channels offline | Oct 12–23, 2026 | Company releases, trade press | Lost sales limited to online share; substitution into stores | High |
| No evidence of sensitive data taken | Oct 19, 2026 | Company release | Thin regulatory and litigation tail, if it holds | Medium |
| Q3 closed Sep 27; Q4 is 14 weeks | Q2 interim report, Aug 5, 2026 | Company filing | Clean Q3; incident hidden by 53rd week unless split out | High |
| CEO handover on Mar 3, 2027 | Oct 21, 2026 | Company release | Incentive to quantify and ring-fence before handover | Medium |
| Buyback continued, price flat | Oct 20, 2026 | Weekly buyback disclosure | Management and market treat it as non-structural | High |
How to score this call
- November 4, 2026: Ahold reiterates its 2026 outlook without lowering the margin, EPS or free cash flow targets. Our estimate: about 75% likely.
- November 4, 2026 or February 2027: Ahold announces a 2027 share buyback of around €1 billion. Our estimate: about 70% likely.
- By the Q4 2026 results in February 2027: Ahold discloses a euro figure for the incident, in the €40–120 million range for total profit impact, with direct costs excluded from underlying operating income. Our estimate: about 60% likely for the full combination; higher for disclosure of some figure alone.
Wider context: what M&S, the Co-op and UNFI paid
The closest precedents come from 2025, when three large food and general retailers were hit within a few months of each other. Their experience is the best available guide to how a grocer’s incident cost evolves from first estimate to final number. It also shows why Ahold’s case likely sits at the cheaper end.
| Retailer (incident) | What was disrupted | First estimate | Later disclosure | Insurance |
|---|---|---|---|---|
| Marks & Spencer (Apr 2025) | Online ordering for weeks, click and collect into August, stock availability | About £300m off 2025/26 operating profit, before mitigation | Around £136m direct costs; H1 statutory profit before tax fell from £391.9m to £3.4m | About £100m expected |
| Co-op Group (Apr 2025) | Back-office and supply systems, shelf availability | £206m revenue and £80m operating profit hit in H1 | Full-year hit of about £120m | Limited cover |
| UNFI (Jun 2025) | Wholesale distribution to retailers | $350–400m sales, $50–60m net income, $40–50m adjusted EBITDA | About 5 points off Q4 sales growth; $15m incident costs in Q4 | Expected to be adequate |
| Ahold Delhaize (Oct 2026) | Websites and apps; stores open throughout | None yet | Base case €40–120m total profit impact | Not disclosed |
The pattern across the three is consistent. The first number was large and round, the final direct cost was smaller, and the biggest losses came where physical supply was disrupted, not where only the website was down. M&S and the Co-op both had store-level availability problems; UNFI’s customers could not get product. Ahold’s disclosures so far describe a narrower event.
The scale also differs. Ahold’s annual net sales run above €90 billion, against roughly £14 billion for M&S and around £11 billion for the Co-op. An incident of similar absolute cost is therefore a far smaller share of profit at Ahold, which is the core reason a guidance hold is the base case.
Regulators are the wild card. Where customer data is taken, fines can dwarf operating losses, as Korea’s record $409 million penalty on Coupang showed. Ahold has said it has no evidence of sensitive data being taken, and it notified the Dutch National Cyber Security Centre within 24 hours. If that position holds through the investigation, the GDPR and US state-law exposure stays small.
Competitive pressure in US grocery is the other backdrop. Rivals spent October fighting for share with membership bundles and price moves, and Albertsons is in court with Kroger over the collapsed merger, as covered in our report on the Albertsons v Kroger damages trial. Eight days without an app is eight days in which a Stop & Shop or Food Lion online customer had every reason to try Instacart, Walmart or Amazon instead.
Implications for grocers, brands, platforms and investors
For grocers
The lesson is about architecture. Ahold’s stores kept trading because the outage was contained to customer-facing systems, and that containment is what likely keeps the bill bounded. Grocers should check whether their e-commerce, loyalty and store operations share identity, payment or inventory systems that would force a whole-estate shutdown. The practical sequence for the first days of an incident is set out in our data breach response playbook for retailers.
The second lesson is about customer retention. Online grocery is a habit business, and the most valuable customers are the weekly delivery households. Expect Ahold’s US banners to lean on credits, free delivery windows and loyalty bonuses through November, which is a margin cost that will show up in Q4 regardless of how the one-off is presented.
For brands and suppliers
Brands that sell through Ahold’s US banners lost about a week of online sell-through, and retail media campaigns on Ahold’s Edge platform could not serve on owned sites while they were down. Suppliers should expect make-good conversations on media spend and should check that their own October sales data, which feed promotional planning, are adjusted for the gap. The outage also falls in the run-up to Thanksgiving, so any knock-on effect on holiday promotional planning matters more than the days lost.
For platforms
Third-party marketplaces and delivery apps were the obvious winners in the outage week. The more durable question is whether retailers rethink the balance between owned and third-party channels as a resilience measure. A grocer that sells only through its own app has no fallback; one that also lists on Instacart or DoorDash can keep some online trade alive. Signals point to more grocers treating third-party listings as a continuity plan, not only as a reach play.
For investors
The two dates to watch are November 4 and the full-year results in February. On November 4, the outlook wording and the buyback decision will show how management sizes the incident. In February, look for the euro figure, how much of it sits outside underlying operating income, and whether any insurance recovery is booked or flagged.
Insurance is the swing factor in the final number. M&S expected about £100 million back from insurers, while the Co-op said its cover was limited. Ahold has not said anything about its cover, so a February disclosure that nets an insurance receivable against the cost would push the reported figure toward the bottom of the range, and a disclosure without one would push it toward the top.
A clean February print would hand Thierry Garnier a base year with the incident already absorbed. That supports the view that his first strategic moves, likely later in 2027, will focus on US price and technology investment rather than repairing the 2026 numbers.
Caveats: what could go wrong
The prediction rests on Ahold’s own description of a contained, digital-only event. Several things could break it.
- Data exposure surfaces later. Ahold’s “no evidence” statement is explicitly provisional. If forensic work later finds that customer or employee data was taken, notification costs, regulatory fines and class actions could push the total well above €120 million, and the incident would stop being a one-quarter story.
- Back-end disruption was deeper than disclosed. The reference to a “phased restoration” of systems “to support the distribution of groceries” hints that some supply or distribution systems were affected. If store availability suffered, the precedent shifts from a website outage toward the M&S and Co-op pattern, where costs ran far higher.
- Customer churn proves sticky. If a meaningful share of US online households stayed with rivals, the loss carries into 2027 online growth. That would not necessarily move 2026 guidance, but it would change the story Garnier inherits.
- Management chooses not to quantify. Some companies fold incident costs into a general explanation without a number. If Ahold does that, part three of this call fails on disclosure even if the economic picture matches the base case.
- Other pressures do the damage. The Q2 report already flagged higher transportation costs linked to the Middle East conflict, and the US margin was declining modestly. If Ahold trims guidance on November 4, the cause may be those pressures rather than the attack, which would make the cyber incident a convenient explanation rather than the driver.
| Scenario | What happens | Our estimate | Tell to watch |
|---|---|---|---|
| Base case | Outlook reiterated Nov 4; ~€1bn 2027 buyback; €40–120m quantified by Feb 2027, mostly outside underlying | ~60% | Unchanged outlook wording on Nov 4 |
| Immaterial | Outlook reiterated; incident described as not material, no euro figure given | ~15% | No line item in Q4 adjustments |
| Downside | Margin guided to “slightly below 4%” or FCF floor lowered; cost above €150m; data exposure confirmed | ~25% | Smaller or delayed buyback; data notification letters |
FAQ
What happened at Ahold Delhaize in October 2026?
On October 12, 2026, Ahold Delhaize detected a security issue and took systems offline, including the websites and apps of most of its brands in the US and Europe. On October 19 it confirmed the activity was caused by malicious actors and filed a police report in the Netherlands. Stores stayed open throughout, and online services were restored brand by brand over the following one to two weeks.
Which US grocery brands were affected?
The Ahold Delhaize USA banners Stop & Shop, Food Lion, Giant Food, The Giant Company and Hannaford all lost their websites and apps for roughly eight days. Trade press reported e-commerce services returning around October 20 and 21. Physical stores were not closed.
Will the cyberattack show up in Ahold’s Q3 2026 results?
Not in the numbers. Ahold’s third quarter closed on September 27, 2026, before the incident began, so the Q3 results on November 4 will not include any of the cost. The financial impact falls in the 14-week fourth quarter, which ends in early January 2027.
How much could the incident cost Ahold Delhaize?
Our base case is €40–120 million of total profit impact, combining lost online sales margin and response costs. That is roughly 1–3% of the group’s annual underlying operating income. The estimate rests on Ahold’s statement that stores stayed open and that no sensitive data appears to have been taken; if either changes, the cost could be materially higher.
Why not expect Ahold to cut guidance, as M&S effectively did?
M&S had weeks of online downtime plus store availability problems, and it is a much smaller company. Ahold’s outage was shorter, limited to digital channels, and lands on a business with net sales above €90 billion. A cost in the base case range moves the group margin by about a tenth of a percentage point, which fits inside an “around 4%” target.
Does the CEO change make a bigger write-down more likely?
It makes clean disclosure more likely, not necessarily a bigger number. Frans Muller remains fully responsible until March 3, 2027, and the February results will be his last. The prior precedent points to outgoing CEOs closing out known issues, so the incoming CEO, Thierry Garnier, starts with them already in the base year.
What is the strongest argument against this prediction?
That Ahold’s “no evidence of data theft” statement is provisional. Retail breaches often look contained at first and widen as forensic work continues. If data exposure is confirmed, regulatory and legal costs could dominate, and a guidance cut or a much larger provision would become more likely.
What should investors watch on November 4?
Three things: whether the 2026 outlook wording is unchanged, whether a 2027 share buyback is announced (last year’s €1 billion program was launched alongside Q3 results), and whether management offers any preliminary range for the incident cost. A smaller or postponed buyback would be the clearest early sign that the bill is larger than the market expects.
What does this mean for other grocers?
It shows that keeping store operations isolated from customer-facing digital systems is what limits the damage. Grocers should test whether a breach in e-commerce would force them to shut stores, and whether third-party marketplaces could keep some online trade alive during an outage of their own apps.