Co-op Data Breach Exposes 6.5 Million Members

In April 2025, the Co-op Group, a prominent UK retailer, experienced a significant cyberattack that compromised the personal data of all 6.5 million members. The breach exposed sensitive information, including names, addresses, and contact details, but financial data remained secure. CEO Shirine Khoury-Haq expressed deep regret over the incident and its impact on customers and staff.

The Cyberattack Unveiled

The attack unfolded in late April when hackers infiltrated Co-op’s IT systems, accessing and extracting personal data of current and past members. The compromised information included names, contact details, and dates of birth. Importantly, no passwords, financial information, transaction data, or details about members’ products or services were accessed. The breach prompted Co-op to shut down parts of its IT systems, causing disruptions in grocery deliveries and leading funeral services to revert to manual operations.

Co-op’s Response and Apology

In response to the breach, Co-op’s CEO, Shirine Khoury-Haq, publicly apologized to the affected members. She expressed devastation over the incident, stating, “I’m devastated that information was taken. I’m also devastated by the impact that it took on our colleagues, as well as they tried to contain all of this.” Khoury-Haq emphasized that while financial data remained secure, the exposure of personal information was a significant concern. She also highlighted the swift actions taken by IT staff to contain the breach, noting, “I met with our IT staff while they were in the midst of it. I will never forget the looks on their faces as they tried to fight off these criminals.”

Ensure your data remains safe and accessible with TrueNASs self-healing technology.

Investigation and Legal Actions

The National Crime Agency (NCA) initiated an investigation into the cyberattack, leading to the arrest of four individuals, including three teenagers and a 20-year-old woman, in connection with the attack. Authorities are examining links to the hacking group Scattered Spider. Additionally, a group legal action has been launched in response to the breach, offering affected individuals a potential route to compensation on a no-win, no-fee basis.

Industry-Wide Implications

This incident underscores the escalating threat of cyberattacks targeting major retailers. The breach at Co-op is part of a broader wave of cyber intrusions affecting UK retailers, including Marks & Spencer and Harrods. The attacks have led to significant operational disruptions and financial losses, prompting a reevaluation of cybersecurity measures within the retail sector.

Co-op’s Future Measures

In the aftermath of the breach, Co-op announced a strategic partnership with The Hacking Games, a UK social impact initiative aimed at steering young cyber talent toward ethical careers. The program will begin with a pilot in Co-op Academies Trust, which runs 38 schools, and will include an independent research study led by Oxford University cybercrime expert Professor David Lusthaus. Khoury-Haq stated, “Our members expect us to find a cooperative means of tackling the cause, not just the symptom. When we expand opportunity, we reduce risk, while having a positive impact on society.”

Conclusion

The Co-op data breach serves as a stark reminder of the vulnerabilities inherent in digital systems and the critical importance of robust cybersecurity measures. As the retail industry continues to digitize, safeguarding customer data must remain a top priority to maintain trust and operational integrity.

References

• Co-op boss confirms data of all 6.5m members stolen. City A.M. (cityam.com)
• Co-op apologises after hackers extract ‘significant’ amount of customer data. The Guardian. (theguardian.com)
• Data on all 6.5m Co-op members stolen in attack – CEO. Sharecast.com. (sharecast.com)
• Data stolen from 6.5 million Co-op members in ‘devastating’ cyber attack. The Standard. (standard.co.uk)
• Co-op boss apologises after 6.5m members had data stolen in cyber attack. Retail Gazette. (retailgazette.co.uk)
• Co-op DragonForce cyber attack includes customer data, firm admits. BBC News. (bbc.com)
• Co-op Cyber-Attack Exposes Data of All 6.5 Million Members in Major Security Breach. International Supermarket News. (internationalsupermarketnews.com)
• UK retail giant Co-op confirms hackers stole all 6.5 million customer records. TechCrunch. (techcrunch.com)
• Co-Op boss says ‘sorry’ to 6.5 million customers whose details were stolen. The Independent. (the-independent.com)
• Co-op boss ‘incredibly sorry’ after cyber attack hits 6.5 million members. Grocery Gazette. (grocerygazette.co.uk)
• Legal action opens after Co-op data breach. Join the Claim. (jointheclaim.com)