When the site goes dark, customers practise shopping elsewhere
2026-10-19
What an outage does to shopping habits, what the evidence says about getting customers back, and why the plan belongs to ecommerce
- Ecommerce
- Cybersecurity
- Retail
- Customer Retention
What an outage does to shopping habits, what the evidence says about getting customers back, and why the plan belongs to ecommerce
Two outages, one weekend
Over the weekend of 11 October, two retail groups found themselves trading without large parts of their technology. TFG London, the UK arm of South Africa's TFG, identified a cybersecurity incident affecting the systems behind Phase Eight, Hobbs and Whistles. Its stores kept trading, and orders placed before the Sunday went out as normal, but several systems stayed unavailable while outside specialists worked through it. Inside Story and White Stuff, which sit in the same business, were not affected.
Ahold Delhaize took systems offline as a precaution on the same weekend. In the Netherlands, Albert Heijn, Etos and Gall & Gall lost online ordering and deliveries, the Bonus loyalty card stopped working, and electronic shelf labels showed the wrong prices. In the US, the websites and apps of all five banners were still down on Wednesday, with notices promising refunds on unfulfilled orders. By the end of the week, Albert Heijn was saying there would be no grocery deliveries until at least the following Sunday.
The detail that stayed with me came from a regional Dutch broadcaster. A woman in Zeeland who normally orders her groceries online from Albert Heijn saw her Monday delivery fail, assumed the shelves would be empty anyway, and drove to Jumbo. It was a bit of an adjustment, she said, because she doesn't usually have to leave the house for groceries. That week, Jumbo, Lidl, Picnic, Aldi and Plus all told the Dutch news agency ANP they were seeing busier stores and more online orders.
Lost orders during an outage are easy to count. Days offline multiplied by average daily online revenue gives the board a number by Friday. What that woman did on Monday afternoon is much harder to put a figure on, and I'd argue it is the larger risk.
Habits live in the context
Online shopping is mostly habitual from a technical point of view. This behaviour is triggered by a cue and involves very little fresh thought. Such cues include the app icon in the same place on the phone, a saved basket, a delivery slot that is booked each week for the same evening, or an email which arrives every Thursday. A habitual customer never compares prices or looks at other competitors before placing an order. This is precisely what makes the habit so valuable to a retailer, but it is also its weakness since the entire process relies on the cue being triggered.
The habit discontinuity hypothesis, set out by Bas Verplanken and Wendy Wood in the Journal of Public Policy and Marketing in 2006, describes what happens when the cue disappears. People fall back on conscious choice. They look around, compare, and become open to options they normally ignore. The paper is 20 years old, so I checked how it has held up. Later fieldwork, including a 2016 experiment by Verplanken and Deborah Roy with people who had recently moved house, supports the core idea that a disrupted context opens a short window in which behaviour can change.
An outage is a context change imposed on every customer at once. The icon is still on the phone, but tapping it produces an error page, so the loop breaks at the moment of action. The customer now has to decide what to do, and a competitor's app is one search away. Every hour the site is down, another slice of the customer base makes a deliberate choice it would never otherwise have had to make.
How long the damage lasts depends on how long you're gone
In this case, the evidence is in conflict, and I believe it is precisely this disagreement that is the most valuable. Amir Tohidi, Dean Eckles and Ali Jadbabaie from MIT carried out a natural experiment using data on household purchases and the permanent closure of stores. When a store that was well known to customers closed, the households had to buy their goods elsewhere and thus tried out products that they would usually have passed on. The ones who had the strongest shopping habits were affected the most, and over time they developed new shopping routines in other stores, leading to permanent changes in the brands they purchased. The study was circulated as a working paper and also appears in Tohidi's 2023 doctoral thesis, so it should be regarded as reliable although it is not the final version.
Marco Kotschedoff, Liliana Kowalczyk and Els Breugelmans, writing in Quantitative Marketing and Economics in 2025, looked at the opposite case: a labour strike that closed a major grocery chain for one week. Shoppers did move to competitors and spent more there while the stores were shut. Once they reopened, people went straight back to their old pattern. The authors put this down to low state dependence, meaning one week of shopping elsewhere wasn't enough to build a new routine.
Read together, the two studies point to duration as the variable that decides the outcome. A short interruption sends customers away and brings them back, because the old cue is restored before a new one has been learned. A long one gives the alternative time to become the new habit. Neither study tells us how many days it takes for one to turn into the other, and both are about physical stores and groceries, so applying them to a fashion site or an app is my inference. The direction is consistent with the habit research, though, and it changes what an incident plan should be built around. Getting some version of the customer journey back quickly is worth more than restoring the full stack perfectly a week later.
The longer version is illustrated by the situation in 2025. Online ordering for clothing and home products was suspended on 25 April, resumed gradually on 10 June, and click and collect wasn't reintroduced until after about 15 weeks. The move had a negative impact on group operating profit of approximately £300m for the year, and the company later stated that sales of its Fashion, Home & Beauty division fell by 16.4% in the first six months. These figures take into account all the lost sales as well as the manual stock handling, so they are unable to say how many online customers had developed habits with other providers during those weeks. The data do, however, show the extent of the disruption for it to have caused such a shift.
Why the apology voucher won't buy them back
The standard reflex after an incident is to apologise and compensate with a discount code, a month of free delivery or a goodwill credit. Part of the thinking is the service recovery paradox, the belief that a customer whose problem is handled brilliantly ends up more loyal than one who never had a problem at all.
The most useful summary of that belief is a meta-analysis by Celso de Matos, Jorge Henrique and Carlos Rossi in the Journal of Service Research in 2007. The paradox does show up in satisfaction, where the combined effect was significant and positive. On repurchase intentions, word of mouth and corporate image, the effect was not significant. The paper is nearly 20 years old and I haven't found a newer meta-analysis that overturns it. Experimental work from the same period found the paradox appears only under narrow conditions, for example, when the failure is minor and the customer doesn't hold the company responsible. A multi-day outage caused by a breach meets neither condition.
So a voucher sent to a customer who has spent a fortnight shopping with a competitor is mostly a subsidy. It may make them feel warmer towards you. On the evidence, it does little to affect whether they come back, and when they do, it gives margin away on orders you might have had anyway. The same money spent on shortening the outage works on the mechanism directly.
The breach that keeps working after the systems are back
There is a second, slower cost when an outage comes from a breach, and ASOS showed it earlier this month. On 6 October, an unauthorised push notification appeared inside the ASOS app claiming the retailer had been hacked. In its update on 8 October, ASOS said an attacker had impersonated a trusted contact to obtain an employee's login, and had reached names, contact details and some account-related information through third-party platforms. Payment cards and passwords were not affected, and the website and app stayed safe to use. Albert Heijn, too, warned customers about phishing while saying it had no evidence of data theft.
The commercial damage lands in the CRM channel. Email and push work because customers trust that a message carrying your brand comes from you. After a breach, criminals may hold names, addresses and order histories, which is precisely the material that makes a fake 'your order is delayed' email convincing. The retailer then has to tell customers to be wary of messages that look like its own, and some customers will apply that advice to the genuine ones as well. I don't have a published figure for how far engagement drops after a breach and I won't make one up. Anyone who runs CRM will recognise the direction, though: once customers learn to hesitate before clicking, the most profitable channel in the business loses part of its pull for months.
Degraded mode is a trading decision
The most interesting move of the week, from an ecommerce point of view, was a line on the US Ahold Delhaize banner websites. With their own sites and apps down, Food Lion, Giant Food and The Giant Company told customers they could still order delivery through Instacart, DoorDash and Uber Eats.
That is clever from the point of view of habit. The platform remains broken, but the brand stays part of the customer's routine since they still place their orders with Food Lion, just via a different channel. The cue changes by a smaller amount than it would if the customer had driven to a competitor, and as a result the time window in which a competitor can establish its own routine is reduced. There is a cost in the form of commission and data that are temporarily held by someone else. However, when there is an outage, time available for the habit becomes the scarce resource and it is this that the commission purchases.
With regard to the stores, TFG London carried out the same approach: the shops remained open, orders that had been placed before the incident were dealt with as usual, and those who ordered after it were asked to expect delays and not to resubmit their orders. Although this last instruction may seem minor, it is extremely important. A customer who does not resubmit and who therefore receives either a duplicate charge or no confirmation will conclude that the brand is faulty; whereas a customer who is given a single clear sentence will wait.
For each of those decisions there is a margin to consider—such things as which journeys to keep going, which partners to switch on, what the holding message should say, and whether it is worth running a static catalogue with phone ordering for a week. These decisions have to be made before an incident, with a person present who understands the economics of each channel.
Why this sits with the Director of Ecommerce
In most businesses I've worked with, the incident plan lives with IT and security, and for containment, forensics and recovery, that is exactly where it belongs. What it usually lacks is a commercial layer. IT can tell you when the platform is safe to switch back on. It can't tell you whether to send customers to a delivery partner on day two, what that costs in commission set against the lifetime value of the customers you'd otherwise lose, or what to put in the app so people wait instead of leaving.
Those are ecommerce decisions. A Head of Ecommerce or Director of Ecommerce who hasn't thought them through in advance will be making them at two in the morning with half the data missing. The preparation that helps most is narrow. Customers who order on a fixed rhythm- a weekly grocery slot, a monthly replenishment, a regular payday shop- depend most on the cue, so they break first, and they are worth the most. Knowing who they are, and which route you would open for them on day one, is the part of the plan only ecommerce can write.
Two outages in one weekend, after the run of attacks on UK retailers in 2025, are a fair hint that this will reach more of us. The day count in the board pack will be the visible cost. The habits customers form while you're gone are the expensive ones.