Hacks That Melt Freezers and $277M Sales: Boards Ask the Wrong Question

Ahold Delhaize says a cyberattack could cost it up to 250 million euros ($277 million) in sales and as much as 100 million euros in operating profit in the fourth quarter alone. That figure, disclosed by the Dutch grocery group, is the sharpest measure yet of what a breach costs when a company cannot keep trading through it. Yet the number answers only half the question boards should be asking.

The recent attack on European supermarkets pushed temperatures in some Swedish freezers to 131 F (55 C), spoiling stock. A separate spate of hacks — including a $6.3 billion heist at crypto exchange Binance — exposes a blind spot in many boardrooms, according to the analysis. Directors ask whether attackers can break in. They rarely ask whether the business can take the hit and keep running.

The prescribed posture is blunt: assume attackers will get through. It is a question of when, not if. When they do, can the company still fulfill orders, pay staff and keep critical facilities open?

What separates Ahold Delhaize from Marks & Spencer?

Containing an attack sometimes means shutting down the very systems that keep a business operating. Ahold Delhaize took some of its own websites and apps offline as a precaution, cutting off online shopping for some customers. It contained most of the disruption within two weeks and was returning to normal by the time it reported third-quarter results. In Belgium, online shopping was back a week after the breach was disclosed.

Marks & Spencer fared worse. After a breach in April 2025, the British retailer stopped taking online clothing orders for 46 days. When orders resumed, only part of the clothing range was available.

The gap between the two outcomes is the story. One company recovered in weeks; the other lost more than a month and a half of online clothing trade.

Why did warnings not stop the second wave of fridge attacks?

The supermarket hacks followed a similar breach of refrigeration systems at hundreds of French supermarkets, which produced piles of spoiled food and even fires. Danfoss, the Danish industrial company that made the temperature controls, urged customers to update their software and hardware. Weeks later, hackers hit retailers using Danfoss controls again — this time in several European countries, including Sweden and Ireland.

Carrefour said it had installed updates and secured its connections after the first wave, steps it credited with curbing the number of Belgian stores hit. Acting on the first warning blunted the second attack for Carrefour. Other retailers left their refrigeration systems exposed, which the analysis calls unacceptable. Even tight security, though, leaves the core problem: a way to trade when dependent systems go dark.

How much is AI accelerating the threat?

The assessment is stark: cyber threats have changed more in the past six months than in the previous six years, in the author's view, and many companies have not caught up.

• Anthropic's Mythos Preview scored about 83% on a cybersecurity benchmark, versus roughly 67% for Claude Opus 4.6, the company's previous best model. Anthropic says it spotted thousands of security flaws, many serious, across every major operating system and web browser.
• OpenAI last week released GPT-6 Cyber to vetted customers, a model designed to find security flaws and test whether they can be exploited.
• The U.K.'s National Cyber Security Centre says the gap between a flaw becoming public and attackers exploiting it has already shrunk to days, and predicts AI will compress that window further.

Defenders, in short, are getting less time to patch. That compresses the margin for error at exactly the moment AI-driven discovery is expanding the number of holes.

What should companies actually do?

The prescription is operational, not technological. Protect the operations the business can least afford to lose, then drill teams on running them through an attack. When NotPetya hit Maersk in 2017, the shipping giant handled about 80% of its usual volume manually — staff taped paperwork to containers and took orders through personal Gmail accounts.

One suggested drill: have a distribution-center team fulfill a handful of priority orders without the usual order system or company email, confirming orders via a secure offline list, checking stock by hand, arranging transport and logging dispatches on paper to reconcile later. After each drill, measure how much of the normal workload the team handled safely, for how long and where it stalled; assign each fix an owner and a deadline, then run it again.

Notably, the typical cyber audit does not test any of this. One board described in the analysis hired a former spy to run penetration tests; the contractor hacked a few products and found holes, but never tested whether the business could ride out a breach.

The bottom line, per the source: find out how long you can keep serving customers with your systems down — before a real attack answers the question for you.