Major Dutch retailers Albert Heijn, Etos and Gall & Gall were hit by an IT incident that temporarily put websites, apps and customer service out of action and disrupted online deliveries. Stores remained open but an important slice of their digital services was offline — with potentially large commercial consequences. This article explains how liability for those losses is typically decided and what companies should check before the next outage.

How liability is decided: the contract first

Who ultimately pays for lost revenue or extra costs usually comes down to the contract between the retailer and its IT supplier. The service level agreement (SLA) sets out the supplier’s obligations, the expected service levels and the allocation of responsibilities. SLAs can vary widely: some impose a best-effort obligation, others promise specific results (for example 99% uptime or incident response within four hours), and some include explicit guarantees about security or recovery.

The practical difference matters: proving a broken guarantee is different from proving the supplier failed to use reasonable efforts. Outside the SLA, suppliers also have a general duty of care to act like a competent professional, to inform the customer and to warn of foreseeable risks. A breach of that duty can lead to liability even if no strict SLA target was missed.

Evidence and information asymmetry

Establishing responsibility in IT incidents is often difficult. Root causes aren’t always immediately clear and relevant logs and forensic data are frequently held by the supplier. Retailers reported that some systems were deliberately taken offline as a precaution — raising the question whether those defensive choices were justified and who bears the cost of that decision.

Limits on liability: exoneration and its boundaries

Most IT contracts contain exoneration clauses that limit a supplier’s financial exposure, for example by capping damages or excluding certain types of loss such as lost profit or consequential damages. Courts often uphold such clauses in commercial relationships because parties are free to allocate risk. That said, limitations may be set aside or reduced in cases of intent, gross negligence or deliberate recklessness. Judges will weigh the seriousness of the supplier’s error, foreseeability of the loss, and whether the damage could reasonably be insured.

Force majeure and cyber incidents

Force majeure (events outside the parties’ control) can excuse non‑performance, but a cyber or security incident is not automatically outside a supplier’s risk sphere. Contracts that expressly list cyberattacks still require a close look at who was contractually responsible for security, monitoring and recovery. If the supplier carried that responsibility, invoking force majeure may not be appropriate.

Data breaches, regulatory duties and third‑party harm

If personal data are involved, the incident may also trigger data breach notification obligations under the GDPR and potential regulatory penalties. Contracts commonly include clauses on breach notification and cooperation with regulators. Separately, the retailer itself can face claims from customers or partners affected by missed deliveries or failed payments.

Practical damage calculation

Damage assessments typically start from the revenue the business would have generated without the outage and subtract variable costs that were avoided. The press release accompanying the legal analysis used Albert Heijn’s average online turnover of €6.2 million per day and a 4% margin as an illustration — roughly €250,000 in lost margin per day — but actual loss calculations are case specific and can include costs for emergency IT capacity, temporary workarounds and forensic investigations. Each item requires a clear causal link to the supplier’s failure.

What companies should do now

• Review contracts and SLAs: identify guaranteed service levels, security responsibilities and any caps or exclusions on liability.
• Ensure logging and forensic access: agree in advance on logging, notification and investigation rights so the cause can be established quickly.
• Check insurance scope: confirm whether cyber insurance covers business interruption, recovery costs and any regulatory fines, and whether policy conditions are met.
• Classify critical systems: decide which systems are business‑critical and set matching contractual protections and contingency plans.
• Prepare customer and regulator communications: have templates and procedures to meet notification obligations and limit reputational damage.

Liability after an IT outage is rarely automatic. It depends on prior contractual choices, the facts established by investigation and, where applicable, statutory duties such as data‑protection obligations. The simplest way to reduce uncertainty is to make explicit, well‑documented agreements before the next outage — and to test whether insurance and contingency plans actually provide the intended protection.

Source: Original press release