Co-op, London. Credit: WD Stock Photos, Shutterstock
Shirine Khoury-Haq confirmed to the CEO of Co-op that 6.5 million mutual members had their data stolen by a cyberattack in April 2025.
“It hurt my members… and that I do take personally,” Khoury-Haq told the BBC, The woman added, “I am incredibly sorry for this breach.”
Information stolen included names, addresses and contact details. However, no financial information like card numbers or transaction data was accessed. The Co-op reported initially that only “a significant number” of its members were affected.
The attack forced the group – which owns over 2,000 grocery stores and 800 funeral parlours – to shut down IT systems. Several services went back to paper-based operation, and shelves remained empty as a result of disruptions in the supply chain.
Four people, including three teenagers, were arrested last week in connection with the Co-op, M&S, and Harrods cyberattacks. The National Crime Agency investigates potential links. Spider Scattered Hacker collective of English-speaking hackers
The Information Commissioner’s Office encourages members who are concerned to visit their website for assistance.
Should the UK require more firms to have cyber insurance?
Browse all UK news
All the latest financial news.