Co-op Apologises After Cyber Attack Exposes Members' Personal Data

The Co-op has apologised after hackers accessed and extracted personal data belonging to a large number of its members. The company confirmed that names and contact details were stolen, although no financial information or passwords were compromised.

The retail group said it has been facing “sustained malicious attempts” to breach its IT systems. Earlier this week, the Co-op had already shut down parts of its systems to protect its network.

This incident follows similar cyber attacks on other major UK retailers, including Harrods and Marks & Spencer. Marks & Spencer continues to deal with a ransomware attack that has disrupted its ability to process online orders since last Friday.

The National Crime Agency (NCA) is investigating the cyber attacks and stated that while each case is being reviewed separately, they are considering the possibility that the incidents may be linked.

In a statement, a Co-op spokesperson said, “As a result of ongoing forensic investigations, we now know that the hackers were able to access and extract data from one of our systems. This included personal information such as names and contact details of a significant number of current and former members.”

The company stressed that the breach did not involve passwords, bank or card details, transaction records, or customer service data. Measures have been taken to secure the systems and reduce disruption to members, customers, and staff.

While the Co-op's grocery stores and funeral services remain fully operational, some back-office functions and call centre services have been affected.

A National Cyber Security Centre (NCSC) spokesperson said these incidents should serve as a “wake-up call” to businesses. CEO Dr Richard Horne urged organisations to follow cyber security guidelines and ensure proper systems are in place to prevent, respond to, and recover from such attacks.

The investigations into the attacks are ongoing. Authorities are working closely with affected businesses to assess the damage and strengthen cybersecurity across the retail sector.