UK’s Co-op Retailer Hit by Cyberattack, 6.5 Million Members’ Data Exposed

The UK’s Co-op retailer has disclosed that all 6.5 million of its members had their personal data stolen during a devastating cyberattack in April 2024.

Chief Executive Shirine Khoury-Haq confirmed the full extent of the breach in her first public interview since the incident, expressing her devastation over the attack’s impact on both members and employees.

While no financial or transaction data was compromised, the hackers successfully accessed names, addresses, and contact information of the entire membership base.

CEO’s Response and Impact Assessment

Shirine Khoury-Haq delivered a deeply personal response to the cyberattack, stating she was “devastated that information was taken” and particularly affected by the impact on her colleagues who worked tirelessly to contain the breach.

The CEO emphasized that the attack was “personal” to her, having witnessed firsthand the distress of her IT staff during the crisis.

“Early on I met with our IT staff and they were in the midst of it. I will never forget the looks on their faces, trying to fight off these criminals,” Khoury-Haq revealed during her BBC Breakfast interview.

The company’s technical team successfully removed the hackers from their systems and monitored their activities, providing detailed information to authorities about “every mouse click” the criminals made.

The breach specifically targeted Co-op’s membership scheme, where members receive profit shares from the cooperative.

Khoury-Haq acknowledged that while much of the stolen information might already be publicly available, members have legitimate reasons for concern about their data security.

Law enforcement agencies have made significant progress in their investigation, with the National Crime Agency (NCA) arresting four suspects connected to cyberattacks on both Co-op and Marks & Spencer.

The arrests included a 17-year-old British man from the West Midlands, a 19-year-old Latvian man from the West Midlands, a 19-year-old British man from London, and a 20-year-old British woman from Staffordshire.

All four suspects were arrested on suspicion of blackmail, money laundering, Computer Misuse Act violations, and participating in organized criminal activities.

Following their arrests, they were released on bail pending further inquiries, while police seized electronic devices from their properties.

Co-op has implemented several measures in response to the attack, though the company has not disclosed the financial cost of the breach.

The retailer continues working to restore its back-end systems while partnering with cyber-security recruitment initiatives.

Notably, Co-op has joined forces with The Hacking Games, a program designed to identify young talent and redirect their skills toward legitimate cybersecurity careers.

This initiative will pilot with Co-op Academies Trust across 38 schools in England, aiming to prevent future cybercriminals by providing alternative pathways.

The Co-op cyberattack represents one of the most significant data breaches in UK retail history, affecting millions of members.

While the company successfully prevented ransomware deployment and provided crucial evidence to authorities, the incident highlights the ongoing cybersecurity challenges facing major retailers and the importance of robust preventive measures.

Get Free Ultimate SOC Requirements Checklist Before you build, buy, or switch your SOC for 2025 - Download Now