What happened
The Co-operative Group was attacked in April 2025 in the same wave as Marks & Spencer. Attackers contacted Co-op's security leadership on Microsoft Teams on 25 April and by phone about a week later. Personal data of 6.5 million members was stolen, including names, contact details and dates of birth, though not passwords, financial details or transaction records; DragonForce claimed data on 20 million people. Co-op reported a £206 million revenue loss and weeks of empty shelves.
How the deception worked
Co-op's account of the intrusion, given publicly by its leadership, is that the attackers impersonated an employee convincingly enough to have that employee's password reset, then used the re-issued credentials to enter the network. The Teams messages and follow-up phone calls to security staff show the same crew comfortable operating in the victim's own collaboration tools, negotiating and pressuring in real time. Co-op's decision to pull systems down aggressively contained the intrusion before encryption, which is why the damage landed as lost revenue and stolen data rather than ransomware.
AI involvement · No AI reported
No AI involvement reported.
The control that would have caught it· our reading, not a claim from the sources
Caller verification at the service desk, and separate approval paths for resets on high-privilege accounts, would have removed the single conversation that granted access.
Sources (5)
- Cyberattack on Co-op leaves shelves empty, data stolen, and $275M in lost revenueSecurity Affairs·securityaffairs.comOpen ↗
- DragonForce group claims the theft of data after Co-op cyberattackSecurity Affairs·securityaffairs.comOpen ↗
- Data of all 6.5 million Co-op members stolen - CEO says she is 'incredibly sorry'TechRadar Pro·techradar.comOpen ↗
- Beware phony IT calls after Co-op and M&S hacks, says UK cyber centreBBC News·feeds.bbci.co.ukOpen ↗
- Scattered Spider Behind Cyberattacks on M&S and Co-op, Causing Up to $592M in DamagesThe Hacker News·thehackernews.comOpen ↗
This entry summarises public reporting. It is not a legal finding, and details can change as investigations conclude. Found an error? Send a correction.