INCIDENT REPORT · CP-2025-005

Co-op Group cyberattack and member data theft

L3 · ELEVATEDCONFIRMED

The UK's Co-op Group shut down parts of its IT estate after detecting an intrusion; it later confirmed attackers had stolen personal data of all 6.5 million members.

Incident ID: CP-2025-005
Disclosure date: 30 APR 2025
Detection date: Not publicly documented
Affected countries: United Kingdom
Plotted location: Manchester, United Kingdom (Affected organization headquarters)
Threat classification: Level 3 — ELEVATED
Classification rationale: Large food retailer with supply disruption and theft of data on 6.5 million people.
Attack type: Data Breach
Nature: Malicious activity
Attack vector: Not publicly documented
Sectors: Retail, Food & Agriculture
Critical infrastructure: No
Organizations affected: The Co-operative Group
Operational consequences: Stock ordering and logistics were disrupted, leaving empty shelves in some stores. Co-op reported about GBP 206 million in lost revenue and an approximately GBP 80 million hit to first-half 2025 earnings.
Estimated financial impact: Co-op half-year results (Sept 2025): approx. GBP 206 million lost revenue and GBP 80 million underlying profit hit; later guided to about GBP 120 million full-year hit. No USD figure stated by the company.
Attribution (as stated): Linked by NCA arrests (July 2025) to the same suspects as the M&S and Harrods attacks; reported links to Scattered Spider/DragonForce are not officially confirmed

SOURCE REFERENCES

RECORD CREATED 14 NOV 2026 · LAST UPDATED 14 NOV 2026 · Threat levels are editorial assessments, not official government ratings.

Co-op Group cyberattack and member data theft

L3 · ELEVATEDCONFIRMED

The UK's Co-op Group shut down parts of its IT estate after detecting an intrusion; it later confirmed attackers had stolen personal data of all 6.5 million members.

Incident ID

CP-2025-005

Disclosure date

30 APR 2025

Detection date

Not publicly documented

Affected countries

United Kingdom

Plotted location

Manchester, United Kingdom (Affected organization headquarters)

Threat classification

Level 3 — ELEVATED

Classification rationale

Large food retailer with supply disruption and theft of data on 6.5 million people.

Attack type

Data Breach

Nature

Malicious activity

Attack vector

Not publicly documented

Sectors

Retail, Food & Agriculture

Critical infrastructure

Organizations affected

The Co-operative Group

Operational consequences

Stock ordering and logistics were disrupted, leaving empty shelves in some stores. Co-op reported about GBP 206 million in lost revenue and an approximately GBP 80 million hit to first-half 2025 earnings.

Estimated financial impact

Co-op half-year results (Sept 2025): approx. GBP 206 million lost revenue and GBP 80 million underlying profit hit; later guided to about GBP 120 million full-year hit. No USD figure stated by the company.

Attribution (as stated)

Linked by NCA arrests (July 2025) to the same suspects as the M&S and Harrods attacks; reported links to Scattered Spider/DragonForce are not officially confirmed