Black Friday 2026 is just over a month away. For retailers and wholesalers, the run-up to November 27 involves decisions about which products to promote, where to invest advertising spend, how much inventory to secure and whether distribution networks can handle a surge in orders. Yet even a well-planned promotion can unravel if the systems behind it stop working.
What happens when customers cannot check out, warehouse teams stop receiving picking instructions or stores cannot replenish essential products? Lost sales can quickly become a much wider operational problem. Recent incidents at major European retailers show why Black Friday cybersecurity is about more than protecting an online storefront. It also means keeping payments, inventory, fulfillment, supplier operations and physical stores running when something goes wrong. This article examines what happened in recent retail cyberattacks, why the peak shopping season raises the stakes and how retail teams can prepare before Black Friday.
What recent retail cyberattacks reveal
For retailers, the disruption caused by a cyber incident often extends well beyond the compromised system. Some services may fail because of the attack itself. Others may have to be taken offline deliberately to contain the threat. Either way, the consequences can reach customers, stores and distribution centers.
| When | Retailer | What happened | Operational lesson |
|---|---|---|---|
| April 2025 | Marks & Spencer (UK) | Warehouse systems were disconnected; online orders, click-and-collect and in-store ordering were suspended. | Disruption in fulfillment can stop sales across channels. |
| April to May 2025 | Co-op (UK) | Restrictions on systems disrupted stock ordering and replenishment, reducing product availability in some stores. | Keeping stores open does not guarantee products will reach the shelves. |
| October 2026 | Ahold Delhaize (Netherlands and other markets) | Precautionary system shutdowns affected websites, apps, online grocery ordering, delivery and some logistics operations. | Containing a threat can itself interrupt customer services. |
| October 2026 | French supermarket chains | Cyberattacks affected connected refrigeration controls, causing abnormal temperatures and food spoilage. | Cyber incidents can affect physical equipment and product safety. |
These incidents did not all occur during Black Friday. They are useful examples because they show what can go wrong when retail systems and business operations depend on one another.
In 2025, Marks & Spencer (M&S) disconnected warehouse management systems while responding to a cyberattack. Online orders, click-and-collect and in-store ordering were temporarily suspended. It introduced manual forecasting, ordering and replenishment processes to keep stores trading. Co-op also restricted access to systems following an attack, disrupting stock availability. In May, it confirmed that its stock-ordering system was back online and normal supply processes had resumed. Both retailers had to balance incident containment with the day-to-day work of keeping products available.
Ahold Delhaize: Online grocery disruption and a phased logistics recovery
In October 2026, Ahold Delhaize identified a cybersecurity issue on its network and took certain systems offline as a precaution. Its Dutch brands, including Albert Heijn, experienced disruptions to websites, apps, online grocery ordering and delivery. Although physical stores remained open, existing online orders were canceled. Some store replenishment and personalized loyalty services were affected as well.
The company brought systems back online in stages with support from external cybersecurity specialists. Albert Heijn reported on October 14 that its distribution centers had resumed operations that evening and regular deliveries to stores were being restored. Online grocery ordering and delivery were still unavailable at that point. Ahold Delhaize said on October 13 that it had found no evidence at that time of customer or employee data being taken; its investigation remained ongoing.
French supermarkets: Cyberattacks reach refrigeration equipment
Also in October 2026, connected refrigeration systems at several French supermarket chains, including Intermarché and Carrefour, were targeted. Attackers altered equipment settings, with temperatures reportedly rising to as high as 50°C (122°F) in some locations. Stores had to discard spoiled food. Fires were also reported. Intermarché said approximately 150 of its stores were affected.
French authorities launched an investigation, while the national cybersecurity agency ANSSI warned about ongoing risks and urged organizations to secure internet-exposed systems and apply updates. The incidents highlighted vulnerabilities in connected operational equipment, not just conventional IT platforms. Investigators had not established a final account of every entry point or identified the attackers as of the reporting date.
The French attacks and Ahold Delhaize’s incident have not been shown to be connected. Together with the earlier UK cases, they illustrate a common business risk: cyber disruption can interrupt ordering, replenishment and in-store operations even when stores remain physically open. During Black Friday, retailers need both preventive security controls and a workable plan for keeping essential services running.
Why Black Friday increases cybersecurity risk for retailers
The scale of the holiday shopping season makes any disruption harder to absorb. Adobe forecasts $275.1 billion in U.S. online sales during November and December 2026, including $12.9 billion on Black Friday alone. For broader context, the National Retail Federation projects $5.6 trillion in total U.S. retail sales for all of 2026. These figures cover different periods and channels. They still help illustrate the scale of the operations retailers are preparing to support.
More shopping activity does not automatically mean more cyberattacks. The real challenge is that peak-season demand coincides with changes across technology, staffing, promotions and third-party operations. Several pressures often build at once:
- Traffic and transactions spike. Surges in product searches, logins, inventory checks and payment attempts can make it harder to distinguish legitimate demand from malicious bots or distributed denial-of-service (DDoS) traffic.
- Systems change rapidly. Teams roll out discounts, coupons, shipping options, payment methods and loyalty offers under tight deadlines. A configuration error or poorly tested update can have a larger impact during a major promotion.
- More people and vendors need access. Logistics providers, contact centers, marketing agencies and temporary staff may receive additional access to systems. Unused accounts or permissions can remain in place unless they are carefully managed.
- Taking systems offline becomes costly. Security teams may need to isolate a service while ecommerce and operations teams need to keep orders flowing. Restoring an unverified system too quickly can create additional risk.
- Teams face competing priorities. Security may focus on containment, ecommerce on conversion and warehouses on dispatch deadlines. Without agreed decision-making rules, a coordinated response becomes harder.
For retailers, Black Friday cybersecurity is as much about operational resilience as IT security. The key question is not only whether an organization can detect an attack but whether it can continue to serve customers safely while the incident is investigated and contained.
Four weak points in connected retail operations
Modern retailers rarely operate websites, stores, warehouses and suppliers as separate businesses. They share data and depend on each other to complete a sale. This integration makes omnichannel retail possible. It also creates dependencies that can spread disruption.
Omnichannel systems share critical order and inventory data
A customer may order through an app and collect an item from a store. To make that experience work, the ecommerce platform, inventory database, warehouse and store must agree on availability and order status. If stock records or fulfillment systems become unavailable, a functioning website may still be unable to deliver what it sells. Security teams therefore need to map the entire journey from checkout to delivery or collection, rather than review individual servers in isolation.
Third-party access extends the attack surface
Payment processors, logistics partners, software vendors and marketing platforms all connect to retail systems in different ways. According to Verizon’s 2026 Data Breach Investigations Report (DBIR), third parties were involved in 48% of the data breaches examined across the report’s multi-industry dataset. Although this figure covers multiple industries rather than retail alone, it underscores why organizations need to know which vendors can access each service and how quickly a compromised connection can be isolated.
Legacy technology and connected equipment follow different rules
Older point-of-sale systems, inventory applications, cloud storefronts, warehouse automation and refrigeration controls may be managed by different teams and updated on different schedules. Some operational technology cannot be replaced or patched as easily as a standard business application. Retailers should identify equipment that can be reached remotely, restrict unnecessary access and develop protective measures with the teams responsible for operating it safely.
Urgent access requests can become an entry point
During busy periods, employees and contractors need password resets, permission changes and technical assistance. Attackers can exploit that urgency by impersonating a colleague or trusted vendor. Requests involving privileged accounts, authentication resets or new remote access should be verified through an independent, established channel. Effective account security depends on day-to-day procedures as well as technology.
Which cyber threats should retail and wholesale businesses prepare for?
Different attacks create different operational problems. Separating them helps retailers choose controls that protect customers without unnecessarily interrupting sales.
DDoS attacks and storefront outages
A distributed denial-of-service (DDoS) attack floods a website, app or service with traffic to disrupt access. On Black Friday, legitimate demand may already be unusually high. Retail teams should test traffic management and mitigation measures before the event, including whether they might accidentally block real shoppers from browsing or checking out.
Account takeover and credential theft
Attackers may reuse credentials stolen elsewhere, lure customers to fake login pages or impersonate staff to gain access. Customer order information and loyalty balances may be exposed. Compromised employee accounts can also create risks for internal operations. Monitoring unusual sign-ins, requiring stronger authentication for sensitive actions and verifying account-recovery requests all help reduce exposure.
API abuse and promotional fraud
An application programming interface (API) lets ecommerce systems exchange information with apps, payment services and partners. Weak permissions can expose order data or enable unwanted changes. Automated activity may also target inventory visibility, coupon redemption or checkout workflows. The goal is to detect unauthorized behavior without treating every automated shopping service or legitimate integration as malicious.
Ransomware and data theft
Ransomware can encrypt systems, disrupt business processes and be used alongside data theft and extortion. If inventory, ordering or warehouse systems are affected, the consequences can extend far beyond inaccessible files. Verizon’s 2026 DBIR found ransomware present in 48% of the data breaches in its dataset. The percentage refers to breaches in the report rather than every cybersecurity incident worldwide. Even so, the finding shows why recovery planning remains essential.
Attacks on stores, warehouses and connected equipment
As the French supermarket incidents demonstrate, cyberattacks can affect operational technology such as refrigeration controls. The result may be lost inventory, safety concerns or interrupted work. Disconnecting equipment is not always a safe immediate fix, so IT and on-site operations teams need agreed procedures for containment and manual operation.
Bot activity also deserves attention. Akamai reported that, as of December 2025, 47.9% of commerce traffic observed across its global network came from AI bots. Not all such traffic is malicious. The practical task is to distinguish useful automation from activity that threatens performance, data or transaction integrity.
How a cyberattack becomes a financial and operational loss
The most visible cost of a cyber incident is often the work needed to investigate the attack and restore systems. For retailers, however, much of the damage occurs elsewhere in the customer journey. A failed payment, an unfulfilled order and spoiled refrigerated inventory produce different kinds of losses.
Checkout disruption can turn marketing spend into missed sales. A campaign may successfully bring shoppers to the site. If checkout fails, however, the visit may never become a purchase. Some customers will return; others may buy from a competitor. Retailers should therefore track payment success rates, abandoned transactions, cancellations and when failures occur rather than relying on website uptime alone.
Warehouse disruption can affect orders that have already been paid for. When picking instructions, stock records or dispatch systems become unavailable, customers may face delays even if the storefront itself is running. Backlogs can create more cancellations, refunds and customer-service work. In that situation, outstanding order volume and on-time dispatch may be more useful indicators than page-load performance.
For grocers, the products themselves may be at risk. If refrigeration equipment malfunctions, some stock may need to be discarded regardless of how quickly the IT systems recover. Grocery operators must account for temperature requirements, food safety and shelf life, while fashion or general merchandise retailers may face a different mix of inventory and returns pressures.
The work does not end once systems are back online. Teams may need to reconcile payments and stock records, clear customer-service backlogs, verify partner connections and assess whether any breach notification obligations apply. The full business impact of a retail cyberattack includes missed orders, delayed fulfillment, wasted inventory, customer support and recovery costs. Understanding those costs helps determine which services deserve the highest protection and fastest recovery.
When systems go down, what should retailers restore first?
Restoring every system immediately may sound like the obvious goal. In practice, reconnecting a system before it is confirmed safe can increase the risk of further compromise. Leaving too many services offline can make it impossible to serve customers. The right recovery sequence depends on which business functions must remain available.
| Business function | Key decision during an incident | Preparation before Black Friday |
|---|---|---|
| Customer login, checkout and order capture | Can genuine customers continue to transact safely? | Stronger authentication, alternative payment options, criteria for limiting orders |
| Inventory, warehouse and delivery | Can accepted orders still be fulfilled accurately? | Stock reconciliation, partial fulfillment, manual workarounds |
| Store checkout and refrigeration | Can stores operate safely? | Site-level continuity plans and equipment-specific safety procedures |
| Customer support and communications | How will customers receive reliable updates? | Backup communications channels, approved messages, clear ownership |
| Nonessential analytics and personalization | Which features can be paused without stopping core sales? | Defined shutdown options and data-reconciliation plans |
A pure-play online retailer may prioritize authentication and checkout. A grocer may need to place greater emphasis on refrigeration and food safety. The sequence should be agreed by security, ecommerce, logistics and store operations teams before an incident occurs, including the likely impact of disconnecting each critical system.
The UK’s National Cyber Security Centre (NCSC) recommends identifying business-critical services, understanding their technology and supplier dependencies and testing workarounds and recovery plans. The aim is to maintain essential operations at an acceptable level while restoring systems safely, not simply to bring everything online at once.
A practical Black Friday cybersecurity checklist and response plan
With Black Friday approaching, few retailers can redesign their entire technology environment. They can still reduce avoidable exposure and test how well their existing plans would work under pressure.
Before the event: Check access, transactions and recovery
Review vendor access and privileged accounts. Identify which payment partners, logistics providers, agencies, contractors and maintenance vendors can reach critical systems. Remove dormant accounts, review permissions and confirm that a single vendor connection can be restricted if necessary. Include internet-connected store and warehouse equipment in the review.
Test the full purchase-to-delivery process. A working promotion page is not enough. Confirm that discounts apply correctly, payments are recorded, stock levels update, warehouse instructions arrive and customers receive fulfillment information. Make sure teams know who can approve urgent changes and how to roll back a faulty deployment.
Prepare for legitimate traffic spikes and suspicious requests. Review monitoring rules for unusual login attempts, inventory requests and transaction patterns. Marketing teams should share promotion timings and expected traffic with IT and security teams. This helps teams distinguish successful campaigns from suspicious traffic during periods of high demand.
Test data restoration and customer communications. Recover sample order, payment and inventory records and check that they still match. Prepare customer updates explaining which services are available, what happens to existing orders and when new information will be shared. Claims about data exposure should reflect what has actually been confirmed.
During an incident: Rehearse decisions across teams
Consider a scenario in which a suspicious administrator login is detected in the warehouse management system during Black Friday’s busiest hours. Security wants to isolate the account. The warehouse still has dispatch deadlines, ecommerce needs to process paid orders and customer support needs an accurate explanation. Waiting until the incident occurs to decide who has authority can delay the response.
A cross-functional tabletop exercise should bring together security, ecommerce, logistics, store operations, customer support and communications teams. It should answer three operational questions:
| Response stage | What teams need to decide |
|---|---|
| 1. Detect and contain | Which accounts or systems must be isolated, who approves the action and who needs to be informed? |
| 2. Maintain essential operations | Which orders, deliveries and store activities can continue? What manual alternatives are safe? |
| 3. Recover and communicate | What is the safe order for restoring services and how will customers and partners be updated? |
Exercises often expose issues that are easy to miss on paper: an outdated emergency contact, nobody authorized to approve a customer notice outside office hours or a manual stock process that creates discrepancies. Those findings should become assigned improvements, not just notes from a meeting.
A simple preparation timeline
| Timing | Priority |
|---|---|
| 4 to 6 weeks before | Map critical systems, supplier connections and high-risk access permissions. |
| 2 to 3 weeks before | Test checkout-to-fulfillment flows and rehearse a cyber incident scenario. |
| Immediately before | Confirm decision-makers, emergency contacts, recovery steps and customer communications. |
| After the event | Revoke temporary access, review incidents and near misses and document improvements. |
Throughout the event, teams should monitor business outcomes alongside technical alerts: payment success, unfulfilled orders, dispatch delays, store availability and customer inquiries. A server can be online while the shopping experience is still broken. Shared operational measures help teams recognize the real impact sooner and coordinate a response.
Conclusion: Retail cybersecurity is ultimately about keeping business running
No retailer can guarantee that every cyberattack will be prevented. What teams can do is decide which functions must remain available, how to contain disruption, what to restore first and how to keep customers informed. The recent experiences of M&S, Co-op, Ahold Delhaize and French supermarkets show that retail cybersecurity is not confined to websites or internal networks. It reaches into inventory, fulfillment, physical operations and the customer promise. For Black Friday, resilience means not only attracting demand but being able to fulfill it safely.
Public statements and news reports tell us what happened. They rarely explain all the decisions made behind the scenes: why one system was isolated before another, how teams handled fulfillment manually or what worked when operations were restored. Liahnson & Company, through its expert network service, connects businesses with experienced professionals across retail, ecommerce, logistics and IT for one-on-one interviews. Whether the priority is cyber resilience, Black Friday marketing or supply chain planning, firsthand industry experience can help teams evaluate practical options that public information alone may not reveal. Share the challenges your organization is preparing for and Liahnson & Company can help identify professionals with relevant experience.
Source and further reading
- Marks & Spencer — Half Year Results, 2025
- Co-op — Cyber Incident: Further Update, May 2025
- Ahold Delhaize — Cybersecurity Incident Update, October 13, 2026
- Albert Heijn — Cybersecurity Incident Statements, October 2026
- Reuters — Investigation of French Supermarket Refrigeration Attacks, October 2026
- Adobe — 2026 U.S. Holiday Ecommerce Forecast
- NRF — 2026 U.S. Annual Retail Sales Forecast
- Verizon — 2026 Data Breach Investigations Report
- Akamai — Securing the Agentic Storefront, 2026
- UK NCSC — Prepare Your Business Continuity, October 2026