Albert Heijn faces €150 million sales hit after cyberattack

After a week of empty supermarket shelves and cancelled grocery orders, Albert Heijn has missed out on an estimated 120 to 150 million euros in sales, according to retail experts. As home deliveries prepare to restart on Friday, October 23, parent company Ahold Delhaize has filed a police report.

Millions in missed sales across stores & online orders

The problems began on Sunday, October 11, when Ahold Delhaize took systems offline after spotting suspicious activity in its IT network. Albert Heijn's website, app and online deliveries went down, and while shops stayed open, shelves for fruit, vegetables and dairy in particular ran empty.

While Albert Heijn has not said how big the financial damage is, two retail experts calculated the damage at the request of RTL Z.

How was this calculated?

Laurens Sloot, distinguished professor of entrepreneurship in retailing at the University of Groningen, puts the total at around 150 million euros. Sloot estimates that shops normally take in about 360 million euros a week and that 20 to 25 percent of that (70 to 90 million euros) disappeared in the first week.

Online sales, normally around 40 million euros a week, dropped to zero, he said, with another 20 million euros expected to go missing as deliveries restart. Sloot called the in-store figure a rough estimate, partly based on what he hears about extra sales at other supermarkets.

Supermarket expert Erik Hemmes estimates a lower loss figure of 120 million euros. He assumes Albert Heijn normally takes in about 380 million euros a week in total, and that in-store sales ran 10 percent lower on average for roughly a week and a half, with the steepest drop in the first few days. The loss of online sales comes on top.

Both experts stress that their calculations come with a lot of uncertainty. It is unclear, for instance, what a shopper does when the cauliflower is gone: opt for frozen vegetables at Albert Heijn or head to a competitor to do their entire shopping?

Sloot adds that missed sales are not the same as a loss. Albert Heijn does not have to buy products it did not sell, and long-life goods can still be sold later.

However, fixed costs such as rent and electricity keep running. Extra costs include manual stock counts, which Sloot called expensive hours that bring in no sales, and possible markdowns on products nearing their best-before dates.

Ahold Delhaize files police report

Parent company Ahold Delhaize has filed a police report over the incident. The company stated that the incident was the result of malicious actions by third parties in a press release on Monday, October 19.

The retail group, which also owns drugstore Etos and liquor retailer Gall & Gall, notified the Dutch National Cyber Security Centre within 24 hours of discovering the incident.

An investigation into the attack is ongoing, though Ahold Delhaize stated that there is currently no evidence that sensitive customer, employee, or partner data was stolen.

"Taking the systems offline as a precaution was the right decision," said Frans Muller, chief executive of Ahold Delhaize, in a statement quoted by NU. "Although the incident is the result of malicious actions of third parties, we offer our apologies for the inconvenience, especially to our customers."

Albert Heijn says its shops are being restocked normally again, although shoppers may still find the odd gap. The website and app are back, as are the Etos and Gall & Gall sites, and home deliveries are due to restart gradually from Friday, October 23.

The disruption has also pushed the government to explore emergency food reserves.