Ahold Delhaize has warned that a cyberattack could strip up to 250 million euros ($277 million) from sales and wipe as much as 100 million euros off operating profit in the fourth quarter. The Dutch grocery group's disclosure, alongside a string of attacks on European supermarkets, exposes a gap that boards routinely miss: they test whether attackers can break in, but not whether the business can take the hit and keep running.

The recent attack wave reached absurd and costly extremes. In Sweden, hackers pushed supermarket freezer temperatures to 131 F (55 C). A separate heist at crypto exchange Binance netted attackers a staggering $6.3 billion. Ahold Delhaize took some of its own websites and apps down as a precaution, cutting off online shopping for some customers — a defensive move that itself carried a commercial price.

Boards should assume attackers will get through, goes the argument now circulating among governance advisers. It is a question of when, not if. When they do, can the business still fulfill orders, pay staff, and keep critical facilities open?

Why penetration tests are not enough

One board that recently grew worried about cyber threats drafted in a former spy to run a cyber audit. The contractor ran penetration tests, hacked a few of the firm's products, and found holes in its defenses. That is fairly typical. The audit tested whether hackers could penetrate the company's defenses — but stopped short of testing whether the business could ride out a breach.

That gap runs through many companies. Sometimes, stopping an attack from spreading means shutting down the very systems that keep you operating.

The contrast between two European retailers shows what that costs. Ahold Delhaize contained most of the disruption within two weeks and was getting back to normal once it reported third-quarter results. In Belgium, its online shopping was running again just a week after the company disclosed the breach.

Marks & Spencer, the British retail stalwart, fared worse. After a breach in April 2025, it stopped taking online clothing orders for 46 days. When orders finally resumed, only part of its clothing range was available.

What is changing with AI?

AI is raising the stakes sharply. In the view of practitioners watching the field, cyber threats have changed more in the past six months than in the previous six years. Many companies have not caught up.

Some of the newest AI models are spotting security flaws that their predecessors missed, and have worked out how to exploit them. Anthropic's Mythos Preview scored about 83% on a cybersecurity benchmark, against roughly 67% for the company's previous best model, Claude Opus 4.6. Anthropic says the model spotted thousands of security flaws, many of them serious, including in every major operating system and web browser.

Last week, OpenAI released GPT-6 Cyber to vetted customers. The model is designed to find security flaws and test whether they can be exploited.

The U.K.'s National Cyber Security Centre says the gap between a flaw becoming public and attackers exploiting it has already shrunk to just days. The centre predicts AI will compress that window further, giving defenders even less time to patch the holes.

What did the fridge attacks teach retailers?

The supermarket hacks came on the heels of a similar breach of fridges at hundreds of French supermarkets. The result was piles of spoiled food, and fires even broke out.

Danfoss, the Danish industrial company that made the temperature controls, urged its customers to update their software and hardware. Weeks later, hackers hit retailers using Danfoss controls again — this time stores in several European countries, including Sweden and Ireland.

Some chains fared better than others. Carrefour said it had installed updates and secured its connections after the first wave of attacks, steps it credited with curbing the number of its Belgian stores hit. Acting on the first warning helped Carrefour blunt the second attack.

Some retailers left their refrigeration systems exposed — unacceptable, by any standard. But even with tighter security, companies still need a way to trade when the systems they depend on go dark.

What should boards actually do?

Protect the operations you can least afford to lose. Then drill your teams on how to keep them running through an attack. When the malware designated NotPetya hit Maersk in 2017, the shipping giant handled about 80% of its usual volume manually. Staff taped paperwork to containers and took orders through personal Gmail accounts.

Consider a distribution center that needs to keep essential goods moving. Ask one team to fulfill a handful of priority orders without its usual order system or company email:

• Confirm orders using a secure offline list and an agreed backup channel
• Check stock by hand and arrange transport
• Log each dispatch on paper and check those logs against the order system once it is back online

When the drill ends, ask how much of the usual workload the team handled safely, for how long, and where it got stuck. Give each fix an owner and a deadline, then run the drill again.

The final question is the one boards most often skip: how long can you keep serving customers with your systems down? A real attack is a brutal way to get the answer.