The Co-op cyberattack: data on 6.5 million members stolen with a phone call

In spring 2025, attackers impersonated staff to get into Co-op’s systems in the UK and copied data on all of its 6.5 million members. Shelves went empty and sales took a heavy hit.

In April 2025, a few days after Marks & Spencer, the British retailer Co-op was hit by a cyberattack. In July, the company confirmed that the personal data of all its 6.5 million members had been copied.

What happened

• The attackers impersonated employees to trick staff into giving them access to accounts.
• They copied a file containing names, addresses, emails, phone numbers and dates of birth.
• According to Co-op, no passwords, bank card details or transaction records were taken, and the attackers could not go further and install ransomware.
• The group DragonForce claimed the attack; on 10 July 2025, the UK’s National Crime Agency arrested four people aged 17 to 20.

The cost

Stores ran short of products for several weeks. Co-op reported a sales impact of about £206m and expected a hit of about £120m on its annual results.

The same weak spot as M&S

As at Marks & Spencer, the entry point was human: a convincing call or message to someone able to reset access. Technical defences are useless if a well-prepared impersonation can bypass them.

What to do

• Set a strict procedure for password and access resets, with identity checks that a caller cannot fake.
• Train help desk and support teams on impersonation attempts.
• Limit what a single account can copy, and alert on large exports.
• Prepare a message for customers in case their data is exposed.

The best firewall cannot stop someone you let in yourself.

Sources: Co-op statements, PA Media via Hargreaves Lansdown, Grocery Gazette, Acronis, 2025.

Want a website and customer data handled with clear access rules? Tell us about your project through our estimate form: we will reply with an estimate and the next steps.