Ahold Delhaize Cuts 2026 EPS Guidance After October Attack Costs €275-350M in Sales and Income

The retailer disconnected systems after detecting the intrusion, primarily impacting online ordering in the Benelux and US plus Benelux supply chain operations. Restoration took roughly two weeks for most functions, yet full recovery remains ongoing. No evidence of customer or partner data exfiltration was reported at disclosure, distinguishing this event from the prior INC Ransom ransomware incident that exposed 2.2 million records in November 2024.

Procurement and incident filings show repeated targeting of the same retail network without public disclosure of the attack vector or initial access method. The company’s decision to isolate segments limited blast radius but still produced measurable revenue and margin erosion, indicating insufficient pre-positioned redundancy in e-commerce and logistics platforms. Remediation expenses are projected to have negligible 2026 IFRS impact, yet free cash flow guidance was lowered by €200 million.

This pattern reveals chronic underinvestment in segmentation and recovery testing across multi-brand retail IT estates. Financial restatement of guidance directly quantifies the operational cost of that gap, moving beyond generic breach announcements to line-item earnings damage.

Ahold Delhaize will likely face continued scrutiny on supplier payment rules in Serbia compounding the cyber-driven cash-flow shortfall; independent verification of restored system integrity is expected within the next quarterly filing cycle.