Decisions that protected trading days at a price

Paying to move 5,240 checkouts after the vendor's deadline

In 2020 the supplier of our till software announced that the platform Ravessa had run since 2004 would leave support at the end of December 2023. It offered a cloud successor and a plan to move all our stores within fourteen months. Our checkout estate then ran to 5,240 lanes, including 1,310 self-checkouts, across more than 600 stores.

Our finance director, Beatriz Sallent, supported the vendor's plan because it avoided paying for extended support and brought forward about €6 million a year of running savings. Our commercial director, Elena Mompel, wanted the new promotions engine before Christmas 2023. I proposed a slower plan: a pilot in six stores in Teruel province, then nine regional waves cut over on Monday nights, with no changes in any store during Holy Week, the summer season in coastal stores or the seven weeks from mid-November to the Epiphany. That plan could not finish before the vendor's date, so it needed €3.8 million of extended support for 2024 and delayed the promotions engine by eleven months.

The pilot, from March 2022, justified the caution. Weighed fresh items scanned with the wrong price or not at all in 2.7 per cent of cases, because the new software read the barcodes printed by older counter scales differently. Nobody had put the scales in scope. We added scales and label printers to the programme for €5.1 million and moved the first wave from October 2022 to January 2023.

The last store moved in November 2024. No store lost the ability to trade; four had partial outages of more than thirty minutes, all on a Tuesday morning. Sales on the morning after each cutover stayed within 0.5 per cent of forecast, and the average transaction became 7 per cent faster. The programme cost €46 million against a business case of €38 million, mainly because of the scales.

Our trading calendar is now a board document, and any programme touching stores must show where it sits against it.

I would do two things differently. I would put every shop-floor device in scope on the first day, not after a pilot found the gap. And I would have negotiated the price of extended support when we signed the new contract, while the vendor still wanted our business, rather than in 2023 under pressure.

Isolating four distribution centres to contain one attack

At 02:40 on Sunday 12 February 2023, our monitoring team saw servers at the Guadalajara distribution centre being encrypted. Guadalajara supplies 164 stores in Madrid and Castilla-La Mancha. The attacker had entered through a remote-access account used by the maintenance contractor for the centre's automated storage system; the account had no second authentication factor.

By 04:10 I had to decide how far to cut. Our director of logistics, Raúl Bordetas, wanted to isolate Guadalajara alone and keep the other three centres shipping, because Monday's deliveries to more than 400 stores were already being picked. I could not yet say whether the attacker had reached the shared warehouse network. I chose to isolate all four centres and the fresh platform from the rest of the company and to cut every supplier's remote access. That stopped all four centres for nineteen hours. Raúl argued the point hard, and he was right that most of those hours would turn out to have been unnecessary.

We found no spread beyond Guadalajara, and the other centres reopened on Sunday evening. Guadalajara's warehouse system was restored from backups the attacker could not alter and was fully running after 82 hours; meanwhile colleagues picked from printed store orders at about a third of normal speed. Ambient availability in the 164 stores fell from 97 to 86 per cent for a week. The attackers had copied an HR file containing the details of 1,920 warehouse employees and drivers. We notified the Spanish data protection authority at the 61st hour, wrote to every affected person, reported the attack to the police and to INCIBE-CERT, and published a notice to the market on Monday morning. On my recommendation and that of external counsel, the board decided not to pay. The incident cost about €3.2 million directly and €9.6 million of lost sales.

Since then every supplier's remote access passes through a monitored gateway with multi-factor authentication, privileged accounts sit in a vault and each distribution centre sits in its own network segment, so that a future decision to isolate can be narrower.

I would do differently what I could only have done beforehand. With proper segmentation, I could have cut Guadalajara alone at 04:10 with confidence. And I would have drafted the letters to employees in advance; writing them during the incident took a day we needed for other work.

A second card acquirer bought against the cheaper contract

On Saturday 16 December 2023, from 11:20 to 14:05, the processor that handled all our card payments failed. Card payments make up about 78 per cent of the value we take at the till. For two hours and forty-five minutes, more than 600 stores could accept only cash. Managers reported abandoned trolleys in over 200 of them, and we later estimated lost sales at €2.3 million.

I proposed two changes: a second acquirer with automatic routing at the payment gateway, and limited offline acceptance when both routes fail. Our finance director, Beatriz Sallent, opposed the second acquirer because splitting volume would cost us the discount on our existing contract, about €0.4 million a year in extra fees. Our head of internal audit objected to offline acceptance, under which the retailer bears the loss if a card is later declined. Both objections were sound, and I did not pretend otherwise in the paper.

We agreed limits that answered each objection in part. Offline acceptance applies only during a declared outage, only up to €80 per transaction, only for checks the card terminals can perform locally, and for no more than three hours, after which stores revert to cash and other methods. Routing sends a small share of normal traffic to the second acquirer every day, so that we know it works before we need it. The build cost €1.7 million and went live in June 2024. The finance director accepted the higher fee on condition that we report the cost of the arrangement against any outage it absorbs.

On Friday 19 September 2025 our main processor failed again, for fifty-five minutes during the evening peak. Routing moved traffic to the second acquirer within two minutes, and 97 per cent of card payments completed. Stores accepted €286,000 offline when both routes briefly failed; €3,100 of that was later declined. We now run card-payment resilience as a service with a named owner and a quarterly test in a trading store.

I would do two things differently. I would have bought the second route before the December outage, when I first raised the risk in 2022 and accepted a no without pressing for a decision. And I would have prepared a short script for checkout staff; on the day, each store improvised its own explanation to customers, and some were better than others.

Letting a forecasting model order only what it could predict

In 2023 our fresh shrink, meaning fresh food thrown away, marked down or written off, was 4.6 per cent of fresh sales, or about €70 million a year. A specialist vendor proposed machine-learning forecasts that would place every fresh order automatically and cut shrink to 3.2 per cent. Our chief executive, Tomás Ezquerra, wanted full automation by Christmas 2024, in time for our capital markets day, and the business case counted about €1.9 million a year of store managers' time released.

The pilot in forty stores, from January to June 2024, showed a model that was good at some things and poor at others. For packaged fresh lines, dairy and chilled ready meals its errors were small and stable. For fish, butchery and delicatessen counters, and for loose fruit in coastal stores during summer, its errors were wide and it gave no warning of that. I proposed that the model order automatically only in categories where its error range stayed narrow, that store managers approve suggested orders for the rest, and that every override be recorded with a reason. The chief executive accepted this reluctantly. We gave up the Christmas deadline and about half of the hours the business case had counted.

Rollout ran from September 2024 to June 2025. In Holy Week 2025 the model under-forecast fish in coastal stores by about 30 per cent; managers' overrides covered most of the gap, ending the argument. From September 2025 we added regional weather data and each region's school holiday calendar, which differ across Spain.

In the twelve months to June 2026, fresh shrink was 3.9 per cent of fresh sales, about €11 million a year better than in 2023, and availability of fresh lines at eight in the evening rose from 91 to 94.5 per cent. The model now orders 58 per cent of fresh lines by volume on its own. I report the vendor's 3.2 per cent beside our 3.9, because the board approved the investment on the first number. The override record now tells us where the model is weak before a bad week proves it.

I would involve the store managers' representatives before the pilot rather than after it, and I would build the reason-code capture before go-live. For the first three months we recorded overrides without reasons, and lost what they could have taught us.