Ahold Delhaize took some of its own systems offline in October after a cyberattack, and it now expects up to 250 million euros in lost sales in the fourth quarter. In November a separate attack changed the settings on refrigeration controls, so freezers in Swedish and other European stores warmed up and food had to be thrown away. Together they show two ways a company gets hurt: by the attack itself, and by what it has to switch off to survive it.
Shutting down is part of the damage
Stopping a break-in from spreading often means turning off the systems that take orders, run the warehouse and pay staff. Ahold Delhaize contained most of the disruption within two weeks. M&S, in 2025, kept its online clothing shop closed for 46 days. These are different companies hit by different attacks, but a customer saw the difference in the plainest way: one shop was selling again and the other was not.
Even Maersk's 80% by hand was not cheap. The attack still cost it an estimated $250 million to $300 million. What the manual work bought was most of its business running while the computers were rebuilt. A company that can do only 30% by hand loses far more in the same ten days.
Why the question matters more now
The time between a flaw becoming known and attackers using it is getting shorter, and AI is a large part of why. The fridge attacks show how that plays out. The maker of the controls urged its customers to update after the first wave in France, and weeks later a second wave hit stores using the same controls. Updating fast helps, but it cannot promise that nothing gets through.
So the useful question changes. "Can they get in?" has a likely answer of yes, sooner or later. "If we have to switch everything off tomorrow, what can we still ship, sell and pay for?" is the one a manager can improve.
A drill that gives you the number
For example, a distribution center ships 500 orders a day. A manager picks ten priority customers and asks one team to fill their orders for a day with no order system and no company email. The team needs printed pick lists, a printed sheet of customer and carrier phone numbers, a paper log for every dispatch, and an agreed backup channel for confirmations. When the systems come back, someone checks the paper log against the order system.
AI helps before the drill, not during it. An assistant can turn the fields of your order system into a one-page paper form and a reconciliation sheet in minutes, and it can list which tools each step depends on, so the team finds the hidden ones: the shared mailbox, the label printer that needs a login. Print them and keep them in a binder.
At the end, ask how much of the normal workload the team handled safely and where it got stuck. If the answer is 30%, a ten-day outage means about 1,500 orders shipped instead of 5,000. At 80% it means 4,000. Give each fix an owner and a deadline, then run the drill again.
Every business gets this number eventually. The drill gives it to you cheaply, and the second run shows whether the fixes worked.