Coop Group
Company Details
Linkedin ID:
coop-group
Website:
Employees number:
44
Number of followers:
165
NAICS:
47
Industry Type:
Homepage:
co-operative.coop
IP Addresses:
0
Company ID:
COO_1530303
Scan Status:
In-progress
Coop Group Company CyberSecurity Posture
co-operative.coop
Coop Group is a logistics and supply chain company based out of 7224 Rooses Way, Indianapolis, Indiana, United States.
Coop Group A.I CyberSecurity Scoring
Coop Group Risk Score (AI oriented)Between 700 and 749
Coop Group
Updated:
- Powered by our proprietary A.I cyber incident model
- Insurance preferes TPRM score to calculate premium
Coop Group Global Score (TPRM)XXXX
Coop Group
- Instant access to detailed risk factors
- Benchmark vs. industry & size peers
- Vulnerabilities
- Findings
Coop Group Company CyberSecurity News & History
Past Incidents
1
Attack Types
1
The Co-operative Group
Breach
Rankiteo Explanation
Attack with significant impact with customers data leaks
Description: The Co-operative Group recently disclosed that a cyber incident, initially thought to be contained, involved unauthorized access to member records. Hackers exfiltrated personal details—names, email addresses, phone numbers and postal addresses—of both current and former members. No financial, password or sensitive authentication data was compromised, but the theft of contact information raises concerns over potential phishing campaigns and identity fraud. The Co-op is now notifying affected individuals, offering guidance on monitoring communications and implementing enhanced security measures. The incident underscores the persistent threat of data breaches in retail environments, highlighting the importance of robust access controls, timely detection mechanisms and comprehensive incident response plans. Although the stolen data may seem low risk compared to financial credentials, the volume of information taken could still facilitate social engineering attacks and undermine member trust. Regulators are also assessing the adequacy of the Co-op’s security safeguards, with potential implications for compliance and reputational impact. Moving forward, the group is accelerating security audits, strengthening encryption protocols and reviewing third-party access to reduce the likelihood of future breaches.
Coop Group Company Scoring based on AI Models
Cyber Incidents Likelihood 3 - 6 - 9 months
A.I Risk Score Likelihood 3 - 6 - 9 months
Underwriter Stats for Coop Group
Incidents vs Transportation, Logistics, Supply Chain and Storage Industry Average (This Year)
Coop Group has 9.91% fewer incidents than the average of same-industry companies with at least one recorded incident.
Incidents vs All-Companies Average (This Year)
Coop Group has 28.21% more incidents than the average of all companies with at least one recorded incident.
Incident Types Coop Group vs Transportation, Logistics, Supply Chain and Storage Industry Avg (This Year)
Coop Group reported 1 incidents this year: 0 cyber attacks, 0 ransomware, 0 vulnerabilities, 1 data breaches, compared to industry peers with at least 1 incident.
Incident History — Coop Group (X = Date, Y = Severity)
Coop Group cyber incidents detection timeline including parent company and subsidiaries
Coop Group Company Subsidiaries
Coop Group is a logistics and supply chain company based out of 7224 Rooses Way, Indianapolis, Indiana, United States.
Loading...
Coop Group Similar Companies
As the custodian of ports, rail and pipelines, Transnet’s objective is to ensure a globally competitive freight system that enables sustained growth and diversification of the country’s economy. As a state-owned company, Transnet continues to leave an indelible mark on the lives of all South Afri
Need some help? Get in touch with our friendly team at https://bit.ly/evriwebsite3 Every parcel, every person, every place. Evri is the UK’s biggest dedicated parcel delivery company, leading the way in creating responsible delivery experiences for everyone, everywhere. And we’re doing that by offe
Arvato
𝗪𝗲 𝘀𝗵𝗮𝗽𝗲 𝘀𝘂𝗽𝗽𝗹𝘆 𝗰𝗵𝗮𝗶𝗻𝘀 𝗴𝗹𝗼𝗯𝗮𝗹𝗹𝘆 Logistics seems so simple – just goods in, goods out. For us there is so much more to it. By combining deep industry expertise with the right technologies, we develop innovative supply chain management and e-commerce solutions for our clients. We have aligned our o
ADNOC Logistics & Services
ADNOC L&S is the region’s largest shipping and integrated logistics company and a global energy maritime logistics leader with a world-class asset base. It is the maritime logistics arm of ADNOC Group, a key enabler to ADNOC’s strategy and a catalyst for Abu Dhabi’s growth and diversification, deliv
Österreichische Post AG
Die Österreichische Post AG ist ein international tätiger Post-, Logistik- und Dienstleistungskonzern mit herausragender Bedeutung für Österreich. Konzernweit erwirtschaftete die Post im Jahr 2024 mit ihren rund 28.000 Mitarbeiter*innen einen Jahresumsatz von über 3,1 Mrd EUR. In Österreich umfasst
UPS Supply Chain Solutions
UPS Supply Chain Solutions offers a comprehensive portfolio of services to enhance customers' business performance, including logistics and distribution, transportation and freight, consulting, customs brokerage, and international trade services. UPS provides the expertise and the scale to meet the
DTDC Express Limited
DTDC Express Ltd is one of India’s leading integrated express logistics company offering domestic and international services. DTDC offers a comprehensive range of technology-enabled logistics services, serving a wide spectrum of customers across diverse industry verticals. Today, DTDC operates India
DSV - Global Transport and Logistics
At DSV, we keep supply chains flowing in a world of change. We provide and manage supply chain solutions for thousands of companies every day – from small family-run businesses to large global corporations. Our reach is global, yet our presence is local and close to our customers. Approx. 160,000
C.H. Robinson
C.H. Robinson is the global leader in Lean AI supply chains. For more than a century, companies everywhere have looked to us to reimagine how goods move. Now, as we redefine what’s next for the industry, that same drive fuels our commitment to Building Tomorrow’s Supply Chains, Today™. Trusted by 83
.png)
Coop Group CyberSecurity News
October 09, 2025 07:00 AM
Cyberattacks Upset British Life, Disrupting Car Factories and Grocery Stores
For more than a month, Jaguar Land Rover hasn't built a single car. The company, Britain's largest automaker, shut down its systems on Sept.
October 09, 2025 07:00 AM
Tata Group ‘fighting multiple fires’ after cyber attacks and boardroom splits
Two of Indian Prime Minister Narendra Modi's top lieutenants have held an extraordinary meeting with executives from India's Tata Group as...
September 26, 2025 07:00 AM
EXCLUSIVE: Co-op chose cybersecurity over insurance
The Co-operative Group has confirmed it did not hold dedicated cyber insurance at the time of the April attack that crippled its IT systems...
September 25, 2025 07:00 AM
Empty shelves, empty coffers: Co-op pegs cyber hit at £80m
The Co-operative Group has revealed the cyberattack that knocked its systems offline earlier this year will leave it nursing an £80 million...
September 25, 2025 07:00 AM
Co-op takes £206mn revenue hit from cyber attack
Group falls to £50mn pre-tax loss after April incident that led to empty shelves at its 2300 convenience stores.
September 25, 2025 07:00 AM
Co-op says ‘malicious’ cyber-attack has hit profits by £80m
Retailer says it needs to focus on weaknesses in food business that led to gaps on shelves in its stores.
September 25, 2025 07:00 AM
Co-op says cyber-attack cost it £206m in lost sales
The retailer's IT networks were infiltrated by hackers in April, leading to payment problems and shortages of goods in shops.
September 25, 2025 07:00 AM
JLR, M&S and Co-op: Who is TCS and what is causing the cyber attacks?
Production paused, tens of millions of pounds in daily losses and thousands of Jaguar Land Rover workers impacted, although Britain's...
September 23, 2025 07:00 AM
Which UK retailers have been hit by cyber attacks in 2025?
Marks and Spencer (M&S), the Co-operative Group and Harrods were hit by cyber attacks that crippled their business-critical services, including ecommerce and...
Frequently Asked Questions
Explore insights on cybersecurity incidents, risk posture, and Rankiteo's assessments.
Coop Group CyberSecurity History Information
Official Website of Coop Group
The official website of Coop Group is http://www.co-operative.coop/.
Coop Group’s AI-Generated Cybersecurity Score
According to Rankiteo, Coop Group’s AI-generated cybersecurity score is 707, reflecting their Moderate security posture.
How many security badges does Coop Group’ have ?
According to Rankiteo, Coop Group currently holds 0 security badges, indicating that no recognized compliance certifications are currently verified for the organization.
Does Coop Group have SOC 2 Type 1 certification ?
According to Rankiteo, Coop Group is not certified under SOC 2 Type 1.
Does Coop Group have SOC 2 Type 2 certification ?
According to Rankiteo, Coop Group does not hold a SOC 2 Type 2 certification.
Does Coop Group comply with GDPR ?
According to Rankiteo, Coop Group is not listed as GDPR compliant.
Does Coop Group have PCI DSS certification ?
According to Rankiteo, Coop Group does not currently maintain PCI DSS compliance.
Does Coop Group comply with HIPAA ?
According to Rankiteo, Coop Group is not compliant with HIPAA regulations.
Does Coop Group have ISO 27001 certification ?
According to Rankiteo,Coop Group is not certified under ISO 27001, indicating the absence of a formally recognized information security management framework.
Industry Classification of Coop Group
Coop Group operates primarily in the Transportation, Logistics, Supply Chain and Storage industry.
Number of Employees at Coop Group
Coop Group employs approximately 44 people worldwide.
Subsidiaries Owned by Coop Group
Coop Group presently has no subsidiaries across any sectors.
Coop Group’s LinkedIn Followers
Coop Group’s official LinkedIn profile has approximately 165 followers.
NAICS Classification of Coop Group
Coop Group is classified under the NAICS code 47, which corresponds to Transportation and Warehousing.
Coop Group’s Presence on Crunchbase
No, Coop Group does not have a profile on Crunchbase.
Coop Group’s Presence on LinkedIn
Yes, Coop Group maintains an official LinkedIn profile, which is actively utilized for branding and talent engagement, which can be accessed here: https://www.linkedin.com/company/coop-group.
Cybersecurity Incidents Involving Coop Group
As of December 18, 2025, Rankiteo reports that Coop Group has experienced 1 cybersecurity incidents.
Number of Peer and Competitor Companies
Coop Group has an estimated 6,289 peer or competitor companies worldwide.
What types of cybersecurity incidents have occurred at Coop Group ?
Incident Types: The types of cybersecurity incidents that have occurred include Breach.
How does Coop Group detect and respond to cybersecurity incidents ?
Detection and Response: The company detects and responds to cybersecurity incidents through an communication strategy with notifying affected individuals, offering guidance on monitoring communications, and enhanced monitoring with implementing enhanced security measures..
Incident Details
Can you provide details on each incident ?
Title: Co-operative Group Data Breach
Description: The Co-operative Group disclosed unauthorized access to member records, exfiltrating personal details of current and former members. No financial or sensitive authentication data was compromised, but the theft of contact information raises concerns over potential phishing campaigns and identity fraud.
Type: Data Breach
Attack Vector: Unauthorized Access
Threat Actor: Hackers
What are the most common types of attacks the company has faced ?
Common Attack Types: The most common types of attacks the company has faced is Breach.
Impact of the Incidents
What was the impact of each incident ?
Incident : Data Breach COO849050725
Data Compromised: Names, Email addresses, Phone numbers, Postal addresses
Brand Reputation Impact: Potential undermining of member trust
Identity Theft Risk: High
Payment Information Risk: Low
What types of data are most commonly compromised in incidents ?
Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Names, Email Addresses, Phone Numbers, Postal Addresses and .
Which entities were affected by each incident ?
Incident : Data Breach COO849050725
Entity Name: The Co-operative Group
Entity Type: Retail
Industry: Retail
Customers Affected: Current and former members
Response to the Incidents
What measures were taken in response to each incident ?
Incident : Data Breach COO849050725
Communication Strategy: Notifying affected individuals, offering guidance on monitoring communications
Enhanced Monitoring: Implementing enhanced security measures
Data Breach Information
What type of data was compromised in each breach ?
Incident : Data Breach COO849050725
Type of Data Compromised: Names, Email addresses, Phone numbers, Postal addresses
Sensitivity of Data: Medium
Data Exfiltration: Yes
Personally Identifiable Information: Yes
Regulatory Compliance
Were there any regulatory violations and fines imposed for each incident ?
Incident : Data Breach COO849050725
Regulatory Notifications: Regulators assessing the adequacy of security safeguards
Lessons Learned and Recommendations
What lessons were learned from each incident ?
Incident : Data Breach COO849050725
Lessons Learned: Importance of robust access controls, timely detection mechanisms and comprehensive incident response plans
What recommendations were made to prevent future incidents ?
Incident : Data Breach COO849050725
Recommendations: Accelerating security audits, strengthening encryption protocols and reviewing third-party access
What are the key lessons learned from past incidents ?
Key Lessons Learned: The key lessons learned from past incidents are Importance of robust access controls, timely detection mechanisms and comprehensive incident response plans.
What recommendations has the company implemented to improve cybersecurity ?
Implemented Recommendations: The company has implemented the following recommendations to improve cybersecurity: Accelerating security audits and strengthening encryption protocols and reviewing third-party access.
Investigation Status
How does the company communicate the status of incident investigations to stakeholders ?
Communication of Investigation Status: The company communicates the status of incident investigations to stakeholders through Notifying affected individuals and offering guidance on monitoring communications.
Post-Incident Analysis
What is the company's process for conducting post-incident analysis ?
Post-Incident Analysis Process: The company's process for conducting post-incident analysis is described as Implementing enhanced security measures.
Additional Questions
General Information
Who was the attacking group in the last incident ?
Last Attacking Group: The attacking group in the last incident was an Hackers.
Impact of the Incidents
What was the most significant data compromised in an incident ?
Most Significant Data Compromised: The most significant data compromised in an incident were Names, Email Addresses, Phone Numbers, Postal Addresses and .
Data Breach Information
What was the most sensitive data compromised in a breach ?
Most Sensitive Data Compromised: The most sensitive data compromised in a breach were Names, Email Addresses, Postal Addresses and Phone Numbers.
Lessons Learned and Recommendations
What was the most significant lesson learned from past incidents ?
Most Significant Lesson Learned: The most significant lesson learned from past incidents was Importance of robust access controls, timely detection mechanisms and comprehensive incident response plans.
What was the most significant recommendation implemented to improve cybersecurity ?
Most Significant Recommendation Implemented: The most significant recommendation implemented to improve cybersecurity was Accelerating security audits and strengthening encryption protocols and reviewing third-party access.
.png)
Latest Global CVEs (Not Company-Specific)
Description
Zerobyte is a backup automation tool Zerobyte versions prior to 0.18.5 and 0.19.0 contain an authentication bypass vulnerability where authentication middleware is not properly applied to API endpoints. This results in certain API endpoints being accessible without valid session credentials. This is dangerous for those who have exposed Zerobyte to be used outside of their internal network. A fix has been applied in both version 0.19.0 and 0.18.5. If immediate upgrade is not possible, restrict network access to the Zerobyte instance to trusted networks only using firewall rules or network segmentation. This is only a temporary mitigation; upgrading is strongly recommended.
Risk Information
cvss3
Base: 9.1
Severity: LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Description
Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter framework. Starting in version 3.4.0 and prior to version 3.4.2, a Cross-Site Request Forgery (CSRF) vulnerability exists in the application's filter configuration. The CSRF protection mechanism was **explicitly disabled**, allowing the application to process state-changing requests (POST) without verifying a valid CSRF token. An unauthenticated remote attacker can exploit this by hosting a malicious web page. If a logged-in administrator visits this page, their browser is forced to send unauthorized requests to the application. A successful exploit allows the attacker to silently create a new Administrator account with full privileges, leading to a complete takeover of the system and loss of confidentiality, integrity, and availability. The vulnerability has been patched in version 3.4.2. The fix re-enables the CSRF filter in `app/Config/Filters.php` and resolves associated AJAX race conditions by adjusting token regeneration settings. As a workaround, administrators can manually re-enable the CSRF filter in `app/Config/Filters.php` by uncommenting the protection line. However, this is not recommended without applying the full patch, as it may cause functionality breakage in the Sales module due to token synchronization issues.
Risk Information
cvss3
Base: 8.8
Severity: LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://github.com/Nixon-H/CVE-2025-68434-OSPOS-CSRF-Unauthorized-Administrator-Creation
- https://github.com/opensourcepos/opensourcepos/commit/d575c8da9a1d7af8313a1e758e000e243f5614ef
- https://github.com/opensourcepos/opensourcepos/pull/4349
- https://github.com/opensourcepos/opensourcepos/security/advisories/GHSA-wjm4-hfwg-5w5r
Description
Zed, a code editor, has an aribtrary code execution vulnerability in versions prior to 0.218.2-pre. The Zed IDE loads Model Context Protocol (MCP) configurations from the `settings.json` file located within a project’s `.zed` subdirectory. A malicious MCP configuration can contain arbitrary shell commands that run on the host system with the privileges of the user running the IDE. This can be triggered automatically without any user interaction besides opening the project in the IDE. Version 0.218.2-pre fixes the issue by implementing worktree trust mechanism. As a workaround, users should carefully review the contents of project settings files (`./zed/settings.json`) before opening new projects in Zed.
Risk Information
cvss3
Base: 7.7
Severity: HIGH
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Description
Zed, a code editor, has an aribtrary code execution vulnerability in versions prior to 0.218.2-pre. The Zed IDE loads Language Server Protocol (LSP) configurations from the `settings.json` file located within a project’s `.zed` subdirectory. A malicious LSP configuration can contain arbitrary shell commands that run on the host system with the privileges of the user running the IDE. This can be triggered when a user opens project file for which there is an LSP entry. A concerted effort by an attacker to seed a project settings file (`./zed/settings.json`) with malicious language server configurations could result in arbitrary code execution with the user's privileges if the user opens the project in Zed without reviewing the contents. Version 0.218.2-pre fixes the issue by implementing worktree trust mechanism. As a workaround, users should carefully review the contents of project settings files (`./zed/settings.json`) before opening new projects in Zed.
Risk Information
cvss3
Base: 7.7
Severity: HIGH
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Description
Storybook is a frontend workshop for building user interface components and pages in isolation. A vulnerability present starting in versions 7.0.0 and prior to versions 7.6.21, 8.6.15, 9.1.17, and 10.1.10 relates to Storybook’s handling of environment variables defined in a `.env` file, which could, in specific circumstances, lead to those variables being unexpectedly bundled into the artifacts created by the `storybook build` command. When a built Storybook is published to the web, the bundle’s source is viewable, thus potentially exposing those variables to anyone with access. For a project to potentially be vulnerable to this issue, it must build the Storybook (i.e. run `storybook build` directly or indirectly) in a directory that contains a `.env` file (including variants like `.env.local`) and publish the built Storybook to the web. Storybooks built without a `.env` file at build time are not affected, including common CI-based builds where secrets are provided via platform environment variables rather than `.env` files. Storybook runtime environments (i.e. `storybook dev`) are not affected. Deployed applications that share a repo with your Storybook are not affected. Users should upgrade their Storybook—on both their local machines and CI environment—to version .6.21, 8.6.15, 9.1.17, or 10.1.10 as soon as possible. Maintainers additionally recommend that users audit for any sensitive secrets provided via `.env` files and rotate those keys. Some projects may have been relying on the undocumented behavior at the heart of this issue and will need to change how they reference environment variables after this update. If a project can no longer read necessary environmental variable values, either prefix the variables with `STORYBOOK_` or use the `env` property in Storybook’s configuration to manually specify values. In either case, do not include sensitive secrets as they will be included in the built bundle.
Risk Information
cvss3
Base: 7.3
Severity: LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Access Data Using Our API
Get company history
curl -i -X GET 'https://api.rankiteo.com/underwriter-getcompany-history?linkedin_id=coop-group' -H 'apikey: YOUR_API_KEY_HERE'
RapidWhat Do We Measure ?
Incident
Finding
Grade
Digital Assets
Every week, Rankiteo analyzes billions of signals to give organizations a sharper, faster view of emerging risks. With deeper, more actionable intelligence at their fingertips, security teams can outpace threat actors, respond instantly to Zero-Day attacks, and dramatically shrink their risk exposure window.
These are some of the factors we use to calculate the overall score:
Network Security
Identify exposed access points, detect misconfigured SSL certificates, and uncover vulnerabilities across the network infrastructure.
SBOM (Software Bill of Materials)
Gain visibility into the software components used within an organization to detect vulnerabilities, manage risk, and ensure supply chain security.
CMDB (Configuration Management Database)
Monitor and manage all IT assets and their configurations to ensure accurate, real-time visibility across the company's technology environment.
Threat Intelligence
Leverage real-time insights on active threats, malware campaigns, and emerging vulnerabilities to proactively defend against evolving cyberattacks.
Rankiteo is a unified scoring and risk platform that analyzes billions of signals weekly to help organizations gain faster, more actionable insights into emerging threats. Empowering teams to outpace adversaries and reduce exposure.
