Co-op
Company Details
Linkedin ID:
the-co-op-group
Website:
Employees number:
20,246
Number of followers:
224,353
NAICS:
43
Industry Type:
Homepage:
coop.co.uk
IP Addresses:
0
Company ID:
CO-_1787391
Scan Status:
In-progress
Co-op Company CyberSecurity Posture
coop.co.uk
Owned by you. Right by you.
Co-op A.I CyberSecurity Scoring
Co-op Risk Score (AI oriented)Between 0 and 549
Co-op
Updated:
- Powered by our proprietary A.I cyber incident model
- Insurance preferes TPRM score to calculate premium
Co-op Global Score (TPRM)XXXX
Co-op
- Instant access to detailed risk factors
- Benchmark vs. industry & size peers
- Vulnerabilities
- Findings
Co-op Company CyberSecurity News & History
Past Incidents
13
Attack Types
2
Co-operative Group (Co-op)
Cyber Attack
Rankiteo Explanation
Attack with significant impact with customers data leaks
Description: In late March 2024, the Co-operative Group disclosed that a sophisticated cyber-attack on its network had resulted in the unauthorized exfiltration of customer data from one of its back-office systems. According to an FAQ posted on the retailer’s website, hackers were able to extract names, residential addresses, email addresses, phone numbers and dates of birth belonging to Co-op Group members. Although the attackers did not gain access to more sensitive information such as member passwords, payment card details or transaction histories, the incident nevertheless represents a significant breach of personal data. In response, the Co-op took multiple systems offline and engaged with the UK’s National Cyber Security Centre (NCSC) to contain the incident and begin the recovery process. The breach has prompted the NCSC to issue fresh guidance to the wider retail sector, emphasizing the need for robust multi-factor authentication, vigilant monitoring of privileged accounts, and rapid assimilation of threat intelligence. Senior government figures have described the attack as a "wake-up call" for all organizations to treat cybersecurity as a strategic priority. The Co-op continues to investigate the full scope of the compromise and is notifying affected members while reinforcing its defenses to prevent future intrusions.
Co-op
Cyber Attack
Rankiteo Explanation
Attack threatening the organization’s existence
Description: The Co-op, a UK-based food-to-funerals group, suffered a **sophisticated, multi-stage cyber attack in April**, initiated via **social engineering** (impersonating an employee). Though the attack was **contained within minutes**, its fallout caused **£200M in lost sales (6 months to July)**, with projections reaching **£300M by next year** and a **£120M annual profit hit**. Systems remained disrupted, leading to ongoing operational challenges. The attackers attempted **ransomware deployment** (4,000 attempts/minute over hours), but malware was blocked. The incident exposed **underinsurance gaps**, with unrecoverable losses. The Co-op’s H1 2023 results plummeted from a **£3M profit to a £75M loss**, compounded by higher employee costs. Leadership cited **youth disenfranchisement** as a root cause of cyber threats and partnered with *The Hacking Games* for mitigation.
Co-op
Cyber Attack
Rankiteo Explanation
Attack threatening the organization's existence
Description: Co-op suffered a severe cyber attack in April, resulting in a £206m revenue loss and an expected full-year revenue drop of £300m, with profits reduced by £120m. The attack disrupted IT systems, causing empty shelves, halted food deliveries, and forced operational restrictions. Criminals impersonated staff to install malware, triggering 4,000 ransomware attempts per minute before defenses blocked further spread. While tills remained operational, the breach compromised the personal data (names, addresses, contact details) of all 6.5 million members—one of the UK’s largest retail data breaches. The incident also led to leadership changes, including the departure of the managing director of the food business, amid declining market share (5.2%, a record low). Recovery efforts continue as systems are gradually restored, with the company vowing to rebuild stronger cyber defenses.
Co-op Group
Cyber Attack
Rankiteo Explanation
Attack threatening the organization’s existence
Description: The Co-op Group, a Manchester-based organization, suffered a severe cyber attack in April 2025, resulting in an £80 million hit to its half-year profits (to July 5, 2025), with an additional projected £40 million loss in the second half of the financial year. The attack disrupted IT systems, causing supply chain failures that led to empty shelves in stores for two weeks. Revenues dropped by 2.1% to £5.484 billion, and a pre-tax profit of £58 million in 2024 turned into a £50 million pre-tax loss in 2025, including the £80 million cyber attack cost. The incident wiped £206 million off revenues, though the company maintained liquidity of £800 million and secured a £350 million lending agreement to stabilize finances. The attack coincided with similar incidents at M&S and Jaguar Land Rover, highlighting the escalating threat of cyber disruptions to critical business operations. Leadership emphasized resilience but acknowledged the need for structural improvements, particularly in the Food business, to mitigate future risks.
The Co-operative Group
Cyber Attack
Rankiteo Explanation
Attack threatening the organization's existence
Description: The Co-operative Group (Co-op) suffered a **malicious cyber attack in April 2025**, resulting in a **£80m ($107m) hit to its H1 2025 operating profits**, including **£20m in one-off costs**. The attack caused **payment disruptions across retail systems**, leading to **£206m in lost sales revenue** and **widespread product shortages**. Critical operations, including **funeral homes**, reverted to **paper-based processes**, while stores faced **empty shelves**. The breach compromised **personal data of all 6.5 million member customers**, exacerbating financial and reputational damage. The incident contributed to a **£75m pre-tax loss** (vs. a £3m profit in H1 2024), with full-year profit impact projected at **£120m**. Limited insurance recovery was expected, as coverage applied only to **immediate response costs**, not long-term losses. The attack exposed vulnerabilities in Co-op’s **IT infrastructure**, particularly in its **Food business**, prompting structural reforms. Group revenue declined **2.1% YoY** (£5.6bn → £5.4bn), though net debt reduced significantly from **£1bn (2021) to £43m**. Leadership acknowledged the attack’s **severe operational and financial consequences**, emphasizing ongoing efforts to mitigate future cyber risks.
The Co-operative Group
Cyber Attack
Rankiteo Explanation
Attack threatening the organization's existence
Description: The Co-operative Group suffered a **sophisticated malicious cyber attack** in April, resulting in a **£75 million underlying pre-tax loss** for the first half of 2025 (down from a £3 million profit the previous year). The attack disrupted operations, causing **£206 million in lost sales** and an **£80 million earnings hit**, including £20 million in one-off costs. Shoppers faced **empty shelves and payment issues**, while the group temporarily shut down IT systems to contain the threat. Hackers **accessed and extracted personal data** of all **6.5 million Co-op members**, creating a copy of a company file but failing to deploy planned ransomware. The breach forced prioritization of essential services (e.g., funerals) and stock allocation to rural stores. The incident exposed vulnerabilities, particularly in the food business, prompting structural changes. The Co-op offered affected members a **£10 discount** as compensation. Leadership emphasized resilience but acknowledged the need for long-term improvements in cybersecurity and business operations.
The Co-operative (Co-op)
Cyber Attack
Rankiteo Explanation
Attack threatening the organization’s existence
Description: The Co-operative (Co-op) suffered a **sophisticated malicious cyberattack** in April 2025, resulting in a **£120 million full-year earnings hit** and a **£206 million sales decline**. The attack disrupted operations, leaving shelves empty and payment systems dysfunctional, while **personal data of all 6.5 million members was stolen** after hackers impersonated employees to gain unauthorized access. Though ransomware was not deployed, the breach forced temporary IT shutdowns, causing a **£75 million pre-tax loss** (down from a £3 million profit the prior year) and a **£32 million operating loss**. Recovery efforts included prioritizing rural stores, supporting franchise partners, and offering customer discounts, but the company continues to face **lingering disruptions in convenience store footfall and back-office operations**. Expansion plans were paused, and leadership restructuring followed. The CEO emphasized the need for **mandatory cyberattack reporting** to combat the UK’s vulnerability to ransomware attacks.
Co-op
Cyber Attack
Rankiteo Explanation
Attack threatening the organization's existence
Description: Co-op experienced a cyberattack that resulted in significant financial losses and operational disruptions. The attack led to a reduction in daily spend by 11 percent for the first 30 days. The impact was particularly severe in remote and rural areas where Co-op acts as a sole provider. The financial hit was substantial, with lost sales, incident response, IT restoration, and legal counsel costs contributing to the overall impact. The attack had knock-on effects for suppliers, partners, and service providers.
Co-op
Cyber Attack
Rankiteo Explanation
Attack threatening the organization's existence
Description: In 2025, Co-op, a major UK retail chain, fell victim to a high-profile cyberattack that resulted in significant financial and reputational damage. The breach exposed customer data, including email addresses, names, phone numbers, and—critically—passwords in nearly half of the incidents. The attack reportedly cost the company around **£300 million** in recovery efforts, disrupting operations and eroding customer trust. The compromised records heightened risks of identity theft, with criminals potentially exploiting stolen credentials for fraudulent activities like unauthorized loans or credit card applications. The incident underscored the vulnerability of retail sectors, which accounted for **25% of all breaches** in 2025, with small and mid-sized businesses being prime targets. Co-op’s breach aligns with broader trends where attackers prioritize personally identifiable information (PII), with **100% of exposures** involving email addresses and **34% including sensitive data** like health or government records. The financial strain and operational disruptions positioned this as a severe threat to the organization’s stability, particularly given the scale of data compromised and the direct impact on customers.
Co-op
Ransomware
Rankiteo Explanation
Attack threatening the organization’s existence
Description: Co-op, a major UK-based retail and financial services cooperative, fell victim to a **ransomware attack by the DragonForce group**, resulting in **substantial financial costs, prolonged operational disruption, and intense public scrutiny**. The attack exposed critical vulnerabilities in their cybersecurity posture, particularly their **lack of dedicated cyber insurance coverage for ransomware**, exacerbating recovery challenges. The incident led to **extended system downtime**, hampering business continuity and eroding customer trust. While the exact financial losses were not fully disclosed, the reputational damage was significant, with media coverage amplifying the fallout. The attack underscored the risks of **underestimating cyber threats**, especially for organizations without robust incident response frameworks or financial safeguards like cyber insurance. The prolonged recovery period further strained resources, highlighting the **interconnected financial, operational, and reputational consequences** of modern ransomware attacks on large enterprises.
Co-op
Ransomware
Rankiteo Explanation
Attack with significant impact with customers data leaks
Description: UK retailer Co-op experienced a significant cyberattack in April that resulted in the theft of personal data of 6.5 million members, causing food shortages in its grocery stores. The attackers successfully copied and accessed the contact information of all members, although no financial or transaction information was exposed. The breach was particularly harmful to the Co-op's members and employees. The CEO, Shirine Khoury-Haq, confirmed the attack and expressed her regret, emphasizing the personal impact on the affected individuals. The attack involved the DragonForce ransomware, and the breach initially occurred through a social engineering attack that allowed threat actors to reset an employee's password and spread to other devices.
Co-op
Ransomware
Rankiteo Explanation
Attack threatening the organization’s existence
Description: The UK-based **Co-op**, a major retail chain, fell victim to a **ransomware attack** in April, orchestrated by the **Scattered Spider** group. The incident disrupted critical operations, particularly targeting **payment systems**, causing widespread chaos in transactions and customer service. While the exact extent of data compromise remains undisclosed, the attack likely exposed **customer data**—a high-value asset on black markets—heightening risks of fraud and reputational damage. The public nature of the breach, amplified by Scattered Spider’s deliberate publicity, intensified pressure on Co-op to respond swiftly, possibly coercing a ransom payment. The attack underscored the retail sector’s vulnerability, where operational disruptions and data theft create compounded financial and trust-related losses. Given Co-op’s prominence, the incident also attracted media scrutiny, further exacerbating reputational harm. The broader trend of **weaponised PDFs** and AI-driven phishing suggests attackers exploited advanced tactics, potentially leveraging **zero-day flaws** to bypass defenses. The attack aligns with a pattern of ransomware groups prioritizing high-profile targets to maximize impact and payouts, even amid a reported decline in overall ransomware volumes.
Co-op
Ransomware
Rankiteo Explanation
Attack threatening the organization’s existence
Description: The UK-based **Co-op**, a major retail chain, fell victim to a **ransomware attack** in April, orchestrated by the **Scattered Spider** group. The incident disrupted operations, particularly targeting **payment systems**, causing significant chaos in-store transactions and online services. While the full extent of the breach remains undisclosed, the attack likely compromised **customer data**, including payment details and personal information, which could be sold on black markets or used for fraud. The public nature of the breach—amplified by Scattered Spider’s deliberate publicity—heightened reputational damage, pressuring Co-op to respond swiftly to restore trust. The attack aligns with a broader trend where retailers are prime targets due to their **high-value financial and personal data**, coupled with the operational urgency to resume transactions. The disruption not only affected sales but also risked long-term customer loyalty, as shoppers may shift to competitors perceiving Co-op as vulnerable. The incident underscores the **evolving tactics of ransomware groups**, who now prioritize **high-impact, high-profile targets** over volume, leveraging media exposure to maximize leverage over victims. Co-op’s response likely involved containment, forensic investigations, and potential ransom negotiations, though details on data recovery or financial losses remain undisclosed. The attack serves as a stark reminder of the **persistent threat landscape**, where even established brands are not immune to sophisticated cyber extortion.
Co-op Company Scoring based on AI Models
Cyber Incidents Likelihood 3 - 6 - 9 months
A.I Risk Score Likelihood 3 - 6 - 9 months
Underwriter Stats for Co-op
Incidents vs Retail Industry Average (This Year)
Co-op has 2471.43% more incidents than the average of same-industry companies with at least one recorded incident.
Incidents vs All-Companies Average (This Year)
Co-op has 1306.25% more incidents than the average of all companies with at least one recorded incident.
Incident Types Co-op vs Retail Industry Avg (This Year)
Co-op reported 9 incidents this year: 5 cyber attacks, 4 ransomware, 0 vulnerabilities, 0 data breaches, compared to industry peers with at least 1 incident.
Incident History — Co-op (X = Date, Y = Severity)
Co-op cyber incidents detection timeline including parent company and subsidiaries
Co-op Company Subsidiaries
Owned by you. Right by you.
Loading...
Co-op Similar Companies
Pick n Pay
Welcome to Pick n Pay, where family values and customer-centricity converge to create an unparalleled shopping experience. Since 1967, when the visionary Raymond Ackerman championed the cause of consumers by acquiring the first few stores, the Ackerman family's dedication has steered our journey of
ALDI USA
Thank you for your interest in ALDI. We are aware of attempts to deceive applicants through fraudulent websites and email domains. Please know, ALDI recruiters will only contact you from an @aldi.us email address. As one of America’s favorite grocers, we believe in offering value and quality in
Shoppers Drug Mart
Built on a foundation of professional expertise and personal service, Shoppers Drug Mart has been meeting Canadians' health care needs for 50 years. What was once a small pharmacy in Toronto has grown into an organization of over 1,200 stores from coast to coast, becoming an indelible part of the l
Mercadona
Mercadona is a leading company of physical supermarkets in Spain with an online service, with over 1,600 stores and more than 5.7 million households as customers. Additionally, it has more than 30 stores in Portugal, with a presence in nine different districts. A family-owned company, its objective
Rumah
Fundada em Junho de 2015, a Rumah é uma loja online especializada em artigos de decoração e itens para a casa, entregando seus produtos para o Brasil inteiro. Com um portfólio grande e variado, a Rumah proporciona diversas opções para seus clientes em várias categorias. Das influências clássicas, m
Sears
Sears is a leading integrated retailer and provider focused on seamlessly connecting the digital and physical shopping experiences to serve our members - wherever, whenever and however they want to shop. We are part of the Transformco family of brands which operates through its subsidiaries, inclu
Woolworths
Woolworths offers a unique blend of food, fashion, beauty and homeware. Since 1931, we’ve found ways to do better, think bigger, inspire more, care more. As we continue to innovate and evolve, our commitment to quality will never change. Woolies Exceptional Quality™ is the driving force of every d
DMart - Avenue Supermarts Ltd
“DMart is a one-stop supermarket chain that aims to offer customers a wide range of basic home and personal products under one roof. Each DMart store stocks home utility products - including food, toiletries, beauty products, garments, kitchenware, bed and bath linen, home appliances and more - avai
Kmart Australia Limited
We’re Team Kmart, on a mission to make everyday living brighter for our customers by improving the Kmart shopping experience – every time and everywhere they engage with us. For over fifty years now, we’ve been spreading the Kmart love to families of all shapes and sizes in Australia, then New Zea
.png)
Co-op CyberSecurity News
November 14, 2025 08:00 AM
Co-op enhances cybersecurity at the world’s largest options exchange network
Eddula is a second-year master's degree student in cybersecurity at Northeastern, and this summer she worked in Chicago as an identity and...
October 09, 2025 07:00 AM
Cyberattacks Upset British Life, Disrupting Car Factories and Grocery Stores
For more than a month, Jaguar Land Rover hasn't built a single car. The company, Britain's largest automaker, shut down its systems on Sept.
October 08, 2025 07:00 AM
Five lessons learned from the M&S, Co-op, and Harrods security breaches
What M&S, Co-op, and Harrods can teach us about cybersecurity failures.
October 01, 2025 07:00 AM
Cyber Security Awareness Month
October's Cyber Security Awareness Month urges UK businesses to strengthen defences amid rising attacks impacting major brands and risking...
September 29, 2025 07:00 AM
New Harrods Data Breach Exposes 430,000 Customer Personal Records
Luxury department store Harrods has disclosed a significant data breach affecting approximately 430000 customer records after a third-party...
September 26, 2025 07:00 AM
EXCLUSIVE: Co-op chose cybersecurity over insurance
Cyber ... The Co-operative Group has confirmed it did not hold dedicated cyber insurance at the time of the April attack that crippled its IT...
September 26, 2025 07:00 AM
UC cybersecurity major discovers learning never stops in IT
Jalen Tucker, a senior cybersecurity major, at the University of Cincinnati discusses the impact three co-ops have had on shaping his career...
September 25, 2025 03:37 PM
Obscura or Hardbit ransomware attack on European Airports n Co-Op Cyber attack loss is £206m
Obscura or Hardbit ransomware attack on European Airports n Co-Op Cyber attack loss is £206m · Obscura or HardBit ransomware behind cyber attacks on European...
September 20, 2025 07:00 AM
Inside the Jaguar Land Rover hack: stalled smart factories, outsourced cybersecurity and supply chain woes
Being a carmaker where 'everything is connected' has left JLR unable to isolate its plants or functions, forcing a shutdown of most systems.
Frequently Asked Questions
Explore insights on cybersecurity incidents, risk posture, and Rankiteo's assessments.
Co-op CyberSecurity History Information
Official Website of Co-op
The official website of Co-op is http://www.coop.co.uk.
Co-op’s AI-Generated Cybersecurity Score
According to Rankiteo, Co-op’s AI-generated cybersecurity score is 100, reflecting their Critical security posture.
How many security badges does Co-op’ have ?
According to Rankiteo, Co-op currently holds 0 security badges, indicating that no recognized compliance certifications are currently verified for the organization.
Does Co-op have SOC 2 Type 1 certification ?
According to Rankiteo, Co-op is not certified under SOC 2 Type 1.
Does Co-op have SOC 2 Type 2 certification ?
According to Rankiteo, Co-op does not hold a SOC 2 Type 2 certification.
Does Co-op comply with GDPR ?
According to Rankiteo, Co-op is not listed as GDPR compliant.
Does Co-op have PCI DSS certification ?
According to Rankiteo, Co-op does not currently maintain PCI DSS compliance.
Does Co-op comply with HIPAA ?
According to Rankiteo, Co-op is not compliant with HIPAA regulations.
Does Co-op have ISO 27001 certification ?
According to Rankiteo,Co-op is not certified under ISO 27001, indicating the absence of a formally recognized information security management framework.
Industry Classification of Co-op
Co-op operates primarily in the Retail industry.
Number of Employees at Co-op
Co-op employs approximately 20,246 people worldwide.
Subsidiaries Owned by Co-op
Co-op presently has no subsidiaries across any sectors.
Co-op’s LinkedIn Followers
Co-op’s official LinkedIn profile has approximately 224,353 followers.
NAICS Classification of Co-op
Co-op is classified under the NAICS code 43, which corresponds to Retail Trade.
Co-op’s Presence on Crunchbase
No, Co-op does not have a profile on Crunchbase.
Co-op’s Presence on LinkedIn
Yes, Co-op maintains an official LinkedIn profile, which is actively utilized for branding and talent engagement, which can be accessed here: https://www.linkedin.com/company/the-co-op-group.
Cybersecurity Incidents Involving Co-op
As of November 30, 2025, Rankiteo reports that Co-op has experienced 13 cybersecurity incidents.
Number of Peer and Competitor Companies
Co-op has an estimated 15,267 peer or competitor companies worldwide.
What types of cybersecurity incidents have occurred at Co-op ?
Incident Types: The types of cybersecurity incidents that have occurred include Ransomware and Cyber Attack.
What was the total financial impact of these incidents on Co-op ?
Total Financial Loss: The total financial loss from these incidents is estimated to be $990 million.
How does Co-op detect and respond to cybersecurity incidents ?
Detection and Response: The company detects and responds to cybersecurity incidents through an containment measures with taking multiple systems offline, containment measures with engaging with the uk’s national cyber security centre (ncsc), and communication strategy with notifying affected members, and law enforcement notified with yes, and containment measures with shut down several it systems, and communication strategy with public apology by ceo, and communication strategy with public disclosure by threat actors (e.g., scattered spider), communication strategy with expert warnings about underreporting, and third party assistance with cybersecurity firms (e.g., ncc group), third party assistance with threat intelligence providers, and containment measures with isolation of infected systems, containment measures with disabling compromised accounts, containment measures with blocking malicious ips, and remediation measures with patching zero-day vulnerabilities, remediation measures with enhancing endpoint detection, remediation measures with updating pdf reader software, and recovery measures with restoring backups, recovery measures with rebuilding payment systems, recovery measures with customer notification campaigns, and communication strategy with limited public disclosure by victims, communication strategy with press statements by cybersecurity experts, communication strategy with advisories to supply chain partners, and network segmentation with recommended for payment systems, and enhanced monitoring with for weaponized pdfs, enhanced monitoring with ai-generated phishing attempts, and incident response plan activated with yes (restrictions placed on systems), and containment measures with system restrictions, containment measures with blocked 4,000 ransomware attempts per minute, and remediation measures with gradual system restoration, remediation measures with leadership review, and recovery measures with phased reboot of it systems, recovery measures with operational adjustments in food business, and communication strategy with public disclosure (july 2023), communication strategy with ceo apology, communication strategy with transparency in financial reports, and incident response plan activated with yes (systems temporarily shut down to contain threat), and containment measures with shut down affected it systems, containment measures with isolated compromised accounts, and remediation measures with prioritized essential services (e.g., funerals, rural stores), remediation measures with supported independent co-op societies and franchise partners, and recovery measures with resumed expansion plans (30 new openings in h2 2025), recovery measures with overhauled leadership, recovery measures with formed new commercial and logistics division, and communication strategy with public disclosure in july 2025, communication strategy with offered £10 discount to members as compensation, communication strategy with media statements by ceo and chairwoman, and and containment measures with partial shutdown of it systems, and recovery measures with entered recovery phase after 2 weeks, recovery measures with maintained trading during disruption, and communication strategy with public announcements on financial impact, communication strategy with statements from chair (debbie white) and ceo (shirine khoury-haq), communication strategy with emphasis on colleague resilience and member support, and and containment measures with temporary shutdown of it systems, containment measures with prevented further ransomware deployment, and recovery measures with prioritized essential services (e.g., funerals), recovery measures with stock prioritization for rural 'lifeline' stores, recovery measures with support for independent co-op societies and franchise partners, recovery measures with £10 discount for members (on £40 shop), and communication strategy with public disclosure in july 2025, communication strategy with statements by chairwoman (debbie white) and ceo (shirine khoury-haq), and incident response plan activated with yes (within minutes of detection), and containment measures with immediate account lockdown, containment measures with malware blocking, containment measures with layered cyber defenses, and remediation measures with system restoration (ongoing), remediation measures with enhanced monitoring, and recovery measures with prioritization of critical services (e.g., vulnerable communities), recovery measures with partnership with *the hacking games* to address root causes, and communication strategy with public disclosure of financial impact, communication strategy with media statements by executives (e.g., rob elsey, shirine khoury-haq), and enhanced monitoring with yes (continuous investment in layered defenses), and incident response plan activated with yes (front-end elements of cyber insurance utilized for immediate response), and third party assistance with yes (technology space third parties via cyber insurance), and remediation measures with refining member and customer proposition, remediation measures with structural changes to the food business, remediation measures with disciplined approach to investment to manage cyber impact in h2 2025, and third party assistance with digital forensics teams, third party assistance with legal counsel, third party assistance with it recovery experts (via cyber insurance), and recovery measures with data backups, recovery measures with encryption, recovery measures with secure storage practices, and communication strategy with crisis communications (covered by cyber insurance), and enhanced monitoring with threat intelligence, enhanced monitoring with network monitoring, and communication strategy with public disclosure via proton data breach observatory; advisory to monitor accounts/bank statements..
Incident Details
Can you provide details on each incident ?
Title: Co-operative Group Data Breach
Description: A sophisticated cyber-attack on the Co-operative Group's network resulted in the unauthorized exfiltration of customer data from one of its back-office systems. Hackers extracted names, residential addresses, email addresses, phone numbers, and dates of birth of Co-op Group members. No access to member passwords, payment card details, or transaction histories was gained.
Date Publicly Disclosed: March 2024
Type: Data Breach
Title: Cyberattacks on Major UK Retail Organizations
Description: Britain's Cyber Monitoring Centre (CMC) estimates the total cost of the cyberattacks that crippled major UK retail organizations recently could be in the region of £270-440 million ($362-591 million). The organization – which launched earlier this year and introduced standardized grading of cyberattacks – gave the criminals' digital intrusions of retail outlets across the country high marks, characterizing them as a category 2 systemic event.
Type: Cyberattack
Title: Co-op Cyberattack
Description: UK retailer Co-op has confirmed that personal data of 6.5 million members was stolen in the massive cyberattack in April that shut down systems and caused food shortages in its grocery stores.
Date Detected: 2023-04-22
Type: Data Breach, Ransomware
Attack Vector: Social EngineeringPassword Reset
Vulnerability Exploited: Weak password policies
Threat Actor: Scattered Spider
Motivation: Financial, Data Theft
Title: Ransomware Attacks Decline by 31% in April 2024, but Akira and Scattered Spider Remain Active
Description: Ransomware attacks dropped 31% in April 2024, with 416 reported cases, marking the second consecutive month of decline. Despite the reduction, high-value targets in retail and industrial sectors—particularly in the US and UK—remained heavily impacted. Akira emerged as the most active ransomware group (65 attacks), followed by Qilin (49) and Play (42). Scattered Spider targeted UK retailers like Co-op, M&S, and Harrods, leveraging public disclosure for pressure. Industrial firms accounted for nearly one-third of attacks (133 cases), while North America bore over half (211) of global incidents. Emerging threats included weaponized PDFs and AI-enhanced phishing, exploiting zero-day vulnerabilities and blurred work-personal device boundaries. Experts warn underreporting masks the true scale of attacks, with geopolitical and economic tensions fueling opportunistic strikes.
Date Publicly Disclosed: 2024-04
Type: ransomware
Attack Vector: weaponized PDFsphishing emailszero-day exploitssocial engineeringpublic disclosure pressure
Vulnerability Exploited: zero-day flaws in PDF softwareunpatched systemshuman error (clicking malicious links/downloads)
Threat Actor: AkiraScattered SpiderQilinPlayBabuk2
Motivation: financial gaindata theft for black market saledisruption of operationsbrand reputation damagegeopolitical/economic opportunism
Title: Global Ransomware Attack Trends in April 2024: Akira and Scattered Spider Dominate, Retail and Industrial Sectors Targeted
Description: Ransomware attacks dropped by 31% in April 2024, with 416 reported cases, marking the second consecutive month of decline. Despite the reduction, high-value targets in retail and industrial sectors—particularly in North America and Europe—remained heavily impacted. Akira emerged as the most active ransomware group (65 attacks), followed by Qilin (49) and Play (42). Scattered Spider targeted UK retailers like Co-op, M&S, and Harrods, leveraging public disclosure tactics to pressure victims. Attackers increasingly used weaponized PDFs and AI-driven phishing to exploit zero-day vulnerabilities. Geopolitical tensions and economic instability were cited as contributing factors to the evolving threat landscape.
Date Publicly Disclosed: 2024-05
Type: ransomware
Attack Vector: weaponized PDFsAI-generated phishing emailssupply chain vulnerabilitiesunpatched zero-day flaws
Vulnerability Exploited: zero-day vulnerabilities in PDF readersweak endpoint securitylack of multi-factor authentication (MFA)poor segmentation of payment systems
Threat Actor: AkiraScattered SpiderQilinPlayBabuk2
Motivation: financial gaindata exfiltration for black market salesbrand reputation damagegeopolitical leveragecyber espionage
Title: Co-op Cyber Attack and Data Breach (2023)
Description: Co-op suffered a crippling cyber attack in April 2023, leading to an IT shutdown that disrupted food deliveries, emptied shelves, and resulted in the theft of 6.5 million members' personal data. The attack caused a £206m revenue hit in the first half of the year, with full-year losses projected at £300m. The company attributed the breach to 'very persistent and very capable' criminals who impersonated staff to install malware, though ransomware deployment was blocked by defenses. No financial or transaction data was stolen, but names, addresses, and contact details were compromised.
Date Detected: 2023-04
Date Publicly Disclosed: 2023-07
Type: Cyber Attack
Attack Vector: Social Engineering (Impersonation)Malware Installation
Vulnerability Exploited: Human Error (Staff Impersonation)
Threat Actor: Unknown (Described as 'very persistent and very capable' criminals)
Motivation: Financial GainData Theft
Title: Cyberattack on The Co-operative Group
Description: The Co-operative Group suffered a sophisticated malicious cyberattack in April 2025, leading to a £120 million full-year earnings hit, £206 million in lost sales, and the theft of personal data for all 6.5 million members. The attack disrupted operations, caused empty shelves, payment issues, and a £75 million underlying pre-tax loss for H1 2025. Hackers impersonated employees to gain access, stole member data, and created copies of internal files but failed to deploy ransomware. The Co-op responded by shutting down affected systems, prioritizing essential services, and offering customer discounts. Recovery efforts are ongoing, with lingering impacts on customer numbers and back-office operations.
Date Detected: April 2025
Date Publicly Disclosed: July 2025
Type: Cyberattack
Attack Vector: Phishing/Social Engineering (impersonation of workers)Credential Theft
Vulnerability Exploited: Human error (employees tricked into granting access)
Motivation: Financial GainData Theft
Title: Co-op Group Cyber Attack Leading to £80m Profit Loss
Description: The Co-op Group suffered a significant cyber attack on April 30, 2025, resulting in a £80m hit to profits, supply chain disruptions, and empty shelves in stores. The attack contributed to a £50m pre-tax loss for the first half of 2025, with revenues falling by 2.1% to £5.484bn. The group anticipates an additional £40m loss in the second half of the year. IT systems were partially shut down, and recovery took two weeks. The incident coincided with similar attacks on M&S and Jaguar Land Rover.
Date Detected: 2025-04-30
Date Publicly Disclosed: 2025-04-30
Type: Cyber Attack
Title: Cyber Attack on The Co-operative Group (April 2025)
Description: The Co-operative Group suffered a sophisticated cyber attack in April 2025, resulting in an £80 million earnings hit, operational disruptions (e.g., empty shelves, payment issues), and the theft of personal data from all 6.5 million members. The attack was contained by shutting down IT systems, preventing further ransomware deployment. The group reported a £75 million pre-tax loss for H1 2025, with sales impacted by £206 million. Recovery efforts included maintaining essential services (e.g., funerals), prioritizing rural stores, and offering members a £10 discount as compensation.
Date Detected: 2025-04
Date Publicly Disclosed: 2025-07
Type: Data Breach
Attack Vector: Sophisticated hacking (details unspecified)
Motivation: Financial GainData Theft
Title: Co-op Cyber Attack (April 2023)
Description: The Co-op, a food-to-funerals group, suffered a sophisticated, multi-staged cyber attack in April 2023. The attack involved social engineering, where hackers impersonated an employee to gain access. The attack was largely contained within minutes, but malware was later discovered and blocked. The incident disrupted systems, leading to an estimated £300 million loss in sales and a £120 million hit to annual profits. The Co-op admitted it was underinsured and unable to recover all losses. The attack highlighted ongoing vulnerabilities, with the company facing thousands of weekly cyber attack attempts. The root cause was attributed in part to 'youth disenfranchisement,' and the Co-op partnered with *The Hacking Games* to address this issue.
Date Detected: April 2023
Type: Cyber Attack
Attack Vector: Social Engineering (Impersonation of Employee)Malware DeploymentRansomware Attempt
Vulnerability Exploited: Human Vulnerability (Social Engineering via Impersonation)
Motivation: Financial Gain (Ransomware Attempt)Potential Data Theft/Disruption
Title: Co-operative Group Cyber Attack (April 2025)
Description: The Co-operative Group reported an £80m ($107m) hit to its H1 2025 operating profits due to a cyber attack in April 2025. The attack disrupted IT systems, caused payment issues, product shortages, and led to the theft of personal data from 6.5 million member customers. The group's funeral homes reverted to paper-based operations, and stores faced empty shelves. The incident contributed to a £206m impact on sales revenue and a £75m underlying pre-tax loss for H1 2025, compared to a £3m profit in the same period the prior year. The full-year profit impact is projected at £120m, with limited insurance recovery.
Date Detected: 2025-04
Type: cyber attack
Title: None
Description: Cyber attacks are no longer a question of if but when. As cybercriminal tactics evolve, organizations face ever-growing risks from ransomware, data breaches, and operational disruption. The financial, regulatory, and reputational consequences can be severe, particularly for SMEs. Cyber insurance is cited as a key tool to mitigate losses, covering business interruption, ransomware payments, legal fees, regulatory fines, and crisis communications. However, insurance alone is insufficient without robust incident response. Examples include Co-op (ransomware by DragonForce, lacking cyber insurance) and Marks & Spencer (third-party access control vulnerability, £300M profit loss). Cyber resilience—combining prevention, detection, response, and recovery—is critical. Proactive measures like incident response planning, data backups, MFA, and threat intelligence, alongside expert-led response, minimize damage and ensure compliance.
Type: ransomware
Attack Vector: third-party vulnerabilitysupply chain compromise
Vulnerability Exploited: access control vulnerability (Marks & Spencer)
Threat Actor: DragonForce (Co-op ransomware)
Motivation: financial gaindata exfiltrationoperational disruption
Title: Proton Data Breach Observatory Findings: 71% of 2025 Breaches Target Small Businesses
Description: New research from Proton's Data Breach Observatory reveals that 71% of data breaches in 2025 have affected firms with under 250 employees, with retail being the most targeted industry. Over 300 million individual records have been exposed across nearly 800 verified breaches, with email addresses (100%), names (90%), and contact info (72%) being the most commonly compromised PII. High-profile UK retailer attacks (e.g., Coop, M&S) incurred recovery costs of ~£300m. The primary risk is identity theft, with criminals using exposed data for fraudulent loans/credit cards.
Date Publicly Disclosed: 2025
Type: Data Breach
Motivation: Financial GainData Theft
What are the most common types of attacks the company has faced ?
Common Attack Types: The most common types of attacks the company has faced is Cyber Attack.
How does the company identify the attack vectors used in incidents ?
Identification of Attack Vectors: The company identifies the attack vectors used in incidents through Social engineering and password reset, weaponized PDFsphishing emailszero-day exploits, weaponized PDFsphishing emailsunpatched softwarestolen credentials, Staff Impersonation, Social engineering (impersonation of workers to trick employees), Social Engineering (Impersonation of Employee) and third-party access control vulnerability (Marks & Spencer).
Impact of the Incidents
What was the impact of each incident ?
Incident : Data Breach THE523050725
Data Compromised: Names, Residential addresses, Email addresses, Phone numbers, Dates of birth
Incident : Cyberattack THE301062325
Financial Loss: £270-440 million ($362-591 million)
Incident : Data Breach, Ransomware THE411071725
Data Compromised: Contact information of 6.5 million members
Systems Affected: IT systemsWindows domain
Downtime: Food shortages in grocery stores
Operational Impact: System shutdowns
Brand Reputation Impact: Significant
Identity Theft Risk: High
Payment Information Risk: None
Incident : ransomware THE1992019091025
Data Compromised: Customer data, Payment system information, Personally identifiable information (pii)
Systems Affected: payment systemsoperational infrastructuresupply chain networks
Operational Impact: disruption of retail operationssupply chain delayscustomer service interruptions
Brand Reputation Impact: publicized breaches (e.g., Co-op, M&S, Harrods)loss of customer trustpotential long-term reputational damage
Identity Theft Risk: high (due to PII exposure)
Payment Information Risk: high (payment systems targeted)
Incident : ransomware THE2462024091125
Data Compromised: Customer payment data, Personally identifiable information (pii), Corporate intellectual property
Systems Affected: payment processing systemsretail POS terminalsindustrial control systems (ICS)supply chain management platforms
Operational Impact: disruption of retail operationssupply chain delaystemporary closure of storesloss of customer trust
Customer Complaints: ['increased due to payment system outages', 'data breach notifications']
Brand Reputation Impact: severe for high-profile retailers (e.g., Co-op, M&S, Harrods)long-term erosion of consumer trust
Identity Theft Risk: ['high due to PII exposure']
Payment Information Risk: ['credit/debit card details', 'transaction histories']
Incident : Cyber Attack THE5632356092525
Data Compromised: Records Exposed: 6, ., 5, , m, i, l, l, i, o, n, , (, m, e, m, b, e, r, s, ', , d, a, t, a, ), Data Types: [, ', N, a, m, e, s, ', ,, , ', A, d, d, r, e, s, s, e, s, ', ,, , ', C, o, n, t, a, c, t, , I, n, f, o, r, m, a, t, i, o, n, ', ],
Systems Affected: IT Systems (Shutdown)Food Delivery SystemsMember Database
Downtime: {'duration': 'Prolonged (systems gradually restored; full recovery timeline unclear)', 'operational_disruption': ['Halted Food Deliveries', 'Empty Shelves', 'Restricted Sales']}
Operational Impact: Supply Chain DisruptionStore Operations Limited (Tills Remained Open)Market Share Decline to 5.2% (record low)
Revenue Loss: £300m (full-year projection)
Brand Reputation Impact: Public Apology by CEOLoss of Customer TrustLeadership Changes (MD Resignation)
Identity Theft Risk: High (Personal Data Stolen)
Payment Information Risk: None (No Financial/Transaction Data Compromised)
Incident : Cyberattack THE4932749092525
Data Compromised: Personal data of all 6.5 million members
Systems Affected: IT systems (partially shut down)Payment systemsInventory managementBack-office operations
Operational Impact: Empty shelvesPayment processing issuesDisrupted supply chainHalting of expansion plans (temporarily)Reduced customer numbers in convenience stores
Revenue Loss: £206 million (sales impact)
Brand Reputation Impact: Negative publicityLoss of customer trust (mitigated by £10 discount offer)
Identity Theft Risk: High (personal data of 6.5 million members stolen)
Incident : Cyber Attack THE3433134092525
Systems Affected: IT Systems (partial shutdown)Supply Chain Systems
Downtime: 2 weeks (recovery phase entered after this period)
Operational Impact: Empty shelves in storesSupply chain disruptionsProduction delays (indirectly mentioned via Jaguar Land Rover comparison)
Revenue Loss: 2.1% (£5.484bn vs. prior period)
Brand Reputation Impact: Potential long-term trust erosionHighlighted resilience in public statements
Incident : Data Breach THE3892438092525
Data Compromised: Personal data of 6.5 million members (file copied by hackers)
Systems Affected: IT systems (partially shut down)Payment systemsInventory management
Operational Impact: Empty shelvesPayment processing issuesDisrupted supply chain (prioritized rural stores)Independent co-op societies and franchise partners affected
Revenue Loss: £206 million (sales impact)
Brand Reputation Impact: Significant (acknowledged by leadership; mitigation via £10 discount for members)
Identity Theft Risk: High (personal data of 6.5 million members stolen)
Incident : Cyber Attack THE1892618092525
Financial Loss: £120 million (annual profit hit); £300 million (potential sales loss)
Systems Affected: Operational Systems (Partial Downtime)Sales Systems
Downtime: Ongoing (some systems not fully restored as of July 2023)
Operational Impact: Disrupted trading, prioritization of vulnerable communities, 4,000 attack attempts per minute during peak
Revenue Loss: £200 million (first six months); £300 million (potential total)
Brand Reputation Impact: Moderate (public disclosure of attack and financial losses)
Incident : cyber attack THE1692016092625
Data Compromised: Personal Data: {, ', c, u, s, t, o, m, e, r, s, _, a, f, f, e, c, t, e, d, ', :, , ', 6, ., 5, , m, i, l, l, i, o, n, , (, m, e, m, b, e, r, , c, u, s, t, o, m, e, r, s, ), ', ,, , ', t, y, p, e, ', :, , [, ', p, e, r, s, o, n, a, l, l, y, , i, d, e, n, t, i, f, i, a, b, l, e, , i, n, f, o, r, m, a, t, i, o, n, , (, P, I, I, ), ', ], },
Systems Affected: IT systems (retailer)payment systemsinventory management systemsfuneral home operations (reverted to paper-based)
Operational Impact: payment disruptionswidespread product shortagesempty shelves in storesfuneral homes reverted to paper-based operations
Revenue Loss: {'sales_revenue_impact': '£206m', 'group_revenue_decline': '2.1% (from £5.6bn in H1 2024 to £5.4bn in H1 2025)'}
Brand Reputation Impact: significant challenges noted by Co-op chair Debbie White; incident described as 'malicious'
Identity Theft Risk: high (due to theft of personal data from 6.5 million customers)
Incident : ransomware THE4262142101725
Financial Loss: £300 million (Marks & Spencer profit loss)substantial costs (Co-op)regulatory fines up to €20M or 4% global turnover (GDPR)
Downtime: ['prolonged (Co-op, Marks & Spencer)']
Operational Impact: business interruptionprolonged recovery
Revenue Loss: ['£300 million (Marks & Spencer)']
Brand Reputation Impact: long-lasting reputational damageloss of customer confidencepublic scrutiny
Legal Liabilities: GDPR finesregulatory penalties
Incident : Data Breach THE4993049103025
Financial Loss: £300 million (estimated for UK retailers like Coop and M&S)
Data Compromised: 300+ million individual records (800 verified breaches); hundreds of billions including compilations
Brand Reputation Impact: High (especially for UK retailers)
Identity Theft Risk: High (primary danger; used for fraudulent loans/credit cards)
What is the average financial loss per incident ?
Average Financial Loss: The average financial loss per incident is $76.15 million.
What types of data are most commonly compromised in incidents ?
Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Names, Residential Addresses, Email Addresses, Phone Numbers, Dates Of Birth, , Contact Information, , Customer Data, Pii, Payment Information, Operational Data, , Pii, Payment Card Data, Corporate Emails, Supply Chain Data, , Personal Identifiable Information (Pii), , Personal Data (Members), , Personal data (members), Personally Identifiable Information (Pii), , Personally Identifiable Information (Pii), Email Addresses (100% Of Breaches), Names (90%), Phone Numbers (72%), Passwords (49%), Health Records (34%), Government Records (34%) and .
Which entities were affected by each incident ?
Incident : Data Breach THE523050725
Entity Name: Co-operative Group
Entity Type: Retailer
Industry: Retail
Incident : Cyberattack THE301062325
Entity Name: Marks & Spencer
Entity Type: Retail
Industry: Retail
Location: UK
Incident : Cyberattack THE301062325
Entity Name: Co-op
Entity Type: Retail
Industry: Retail
Location: UK
Incident : Cyberattack THE301062325
Entity Name: Harrods
Entity Type: Retail
Industry: Retail
Location: UK
Incident : Data Breach, Ransomware THE411071725
Entity Name: Co-op
Entity Type: Retailer
Industry: Retail
Location: United Kingdom
Size: Large
Customers Affected: 6.5 million
Incident : ransomware THE1992019091025
Entity Name: Co-op (UK)
Entity Type: retail
Industry: Consumer Discretionary
Location: United Kingdom
Incident : ransomware THE1992019091025
Entity Name: Marks & Spencer (M&S)
Entity Type: retail
Industry: Consumer Discretionary
Location: United Kingdom
Incident : ransomware THE1992019091025
Entity Name: Harrods
Entity Type: retail
Industry: Consumer Discretionary
Location: United Kingdom
Incident : ransomware THE1992019091025
Entity Name: Unnamed Industrial Firms
Entity Type: manufacturing, industrial
Industry: Industrials
Location: North AmericaEuropeAsiaSouth America
Incident : ransomware THE2462024091125
Entity Name: Co-op (UK)
Entity Type: retail
Industry: Consumer Discretionary
Location: United Kingdom
Size: large
Incident : ransomware THE2462024091125
Entity Name: Marks & Spencer (M&S)
Entity Type: retail
Industry: Consumer Discretionary
Location: United Kingdom
Size: large
Incident : ransomware THE2462024091125
Entity Name: Harrods
Entity Type: retail
Industry: Consumer Discretionary
Location: United Kingdom
Size: large
Incident : ransomware THE2462024091125
Entity Name: Unnamed Industrial Firms
Entity Type: manufacturing, energy, logistics
Industry: Industrials
Location: North AmericaEuropeAsia
Incident : Cyber Attack THE5632356092525
Entity Name: Co-op Group
Entity Type: Retailer, Grocery Chain, Funeral Care, Legal Services, Insurance
Industry: Retail, Food & Beverage, Funeral Services, Legal, Insurance
Location: United Kingdom
Size: Large (2,300+ grocery stores, multiple business units)
Customers Affected: 6.5 million (members)
Incident : Cyberattack THE4932749092525
Entity Name: The Co-operative Group
Entity Type: Retailer, Co-operative Society
Industry: Retail, Funeral Services, Food
Location: United Kingdom
Size: 53,000 employees, 6.5 million members
Customers Affected: 6.5 million members (data breach) + broader customer base (operational disruption)
Incident : Cyber Attack THE3433134092525
Entity Name: Co-op Group
Entity Type: Retail Cooperative
Industry: Retail (Food, Funeralcare, Insurance, Legal Services)
Location: Manchester, UK
Size: 53,000 employees
Incident : Data Breach THE3892438092525
Entity Name: The Co-operative Group
Entity Type: Retailer/Consumer Co-operative
Industry: Retail (Food, Funerals, etc.)
Location: United Kingdom
Size: 53,000 employees; 6.5 million members
Customers Affected: 6.5 million members + shoppers (disrupted services)
Incident : Cyber Attack THE1892618092525
Entity Name: Co-op Group
Entity Type: Retail Cooperative
Industry: Retail (Food), Funeral Services, Insurance, Legal Services
Location: United Kingdom
Size: Large (millions of members)
Incident : cyber attack THE1692016092625
Entity Name: Co-operative Group (Co-op)
Entity Type: retailer, funeral services provider
Industry: retail, funeral services
Location: United Kingdom
Size: large (£5.4bn revenue in H1 2025)
Customers Affected: 6.5 million (member customers)
Incident : ransomware THE4262142101725
Entity Name: Co-op
Entity Type: Retail/Cooperative
Industry: Retail
Location: UK
Incident : ransomware THE4262142101725
Entity Name: Marks & Spencer
Entity Type: Public Limited Company
Industry: Retail
Location: UK
Incident : Data Breach THE4993049103025
Entity Name: Coop (UK Retailer)
Entity Type: Retail
Industry: Retail/Wholesale
Location: United Kingdom
Size: Large (exact size unspecified)
Incident : Data Breach THE4993049103025
Entity Name: Marks & Spencer (M&S)
Entity Type: Retail
Industry: Retail/Wholesale
Location: United Kingdom
Size: Large (exact size unspecified)
Incident : Data Breach THE4993049103025
Entity Name: Small Businesses (10-49 employees)
Entity Type: SME
Industry: Multiple (Retail most common)
Location: Global
Size: 10-49 employees
Incident : Data Breach THE4993049103025
Entity Name: Small Businesses (50-249 employees)
Entity Type: SME
Industry: Multiple (Retail most common)
Location: Global
Size: 50-249 employees
Incident : Data Breach THE4993049103025
Entity Name: Micro Businesses (<10 employees)
Entity Type: Micro Enterprise
Industry: Multiple
Location: Global
Size: <10 employees
Response to the Incidents
What measures were taken in response to each incident ?
Incident : Data Breach THE523050725
Containment Measures: Taking multiple systems offlineEngaging with the UK’s National Cyber Security Centre (NCSC)
Communication Strategy: Notifying affected members
Incident : Data Breach, Ransomware THE411071725
Law Enforcement Notified: Yes
Containment Measures: Shut down several IT systems
Communication Strategy: Public apology by CEO
Incident : ransomware THE1992019091025
Communication Strategy: public disclosure by threat actors (e.g., Scattered Spider)expert warnings about underreporting
Incident : ransomware THE2462024091125
Third Party Assistance: Cybersecurity Firms (E.G., Ncc Group), Threat Intelligence Providers.
Containment Measures: isolation of infected systemsdisabling compromised accountsblocking malicious IPs
Remediation Measures: patching zero-day vulnerabilitiesenhancing endpoint detectionupdating PDF reader software
Recovery Measures: restoring backupsrebuilding payment systemscustomer notification campaigns
Communication Strategy: limited public disclosure by victimspress statements by cybersecurity expertsadvisories to supply chain partners
Network Segmentation: ['recommended for payment systems']
Enhanced Monitoring: for weaponized PDFsAI-generated phishing attempts
Incident : Cyber Attack THE5632356092525
Incident Response Plan Activated: Yes (Restrictions Placed on Systems)
Containment Measures: System RestrictionsBlocked 4,000 Ransomware Attempts per Minute
Remediation Measures: Gradual System RestorationLeadership Review
Recovery Measures: Phased Reboot of IT SystemsOperational Adjustments in Food Business
Communication Strategy: Public Disclosure (July 2023)CEO ApologyTransparency in Financial Reports
Incident : Cyberattack THE4932749092525
Incident Response Plan Activated: Yes (systems temporarily shut down to contain threat)
Containment Measures: Shut down affected IT systemsIsolated compromised accounts
Remediation Measures: Prioritized essential services (e.g., funerals, rural stores)Supported independent co-op societies and franchise partners
Recovery Measures: Resumed expansion plans (30 new openings in H2 2025)Overhauled leadershipFormed new commercial and logistics division
Communication Strategy: Public disclosure in July 2025Offered £10 discount to members as compensationMedia statements by CEO and Chairwoman
Incident : Cyber Attack THE3433134092525
Incident Response Plan Activated: True
Containment Measures: Partial shutdown of IT systems
Recovery Measures: Entered recovery phase after 2 weeksMaintained trading during disruption
Communication Strategy: Public announcements on financial impactStatements from Chair (Debbie White) and CEO (Shirine Khoury-Haq)Emphasis on colleague resilience and member support
Incident : Data Breach THE3892438092525
Incident Response Plan Activated: True
Containment Measures: Temporary shutdown of IT systemsPrevented further ransomware deployment
Recovery Measures: Prioritized essential services (e.g., funerals)Stock prioritization for rural 'lifeline' storesSupport for independent co-op societies and franchise partners£10 discount for members (on £40 shop)
Communication Strategy: Public disclosure in July 2025Statements by Chairwoman (Debbie White) and CEO (Shirine Khoury-Haq)
Incident : Cyber Attack THE1892618092525
Incident Response Plan Activated: Yes (within minutes of detection)
Containment Measures: Immediate Account LockdownMalware BlockingLayered Cyber Defenses
Remediation Measures: System Restoration (Ongoing)Enhanced Monitoring
Recovery Measures: Prioritization of Critical Services (e.g., Vulnerable Communities)Partnership with *The Hacking Games* to Address Root Causes
Communication Strategy: Public Disclosure of Financial ImpactMedia Statements by Executives (e.g., Rob Elsey, Shirine Khoury-Haq)
Enhanced Monitoring: Yes (continuous investment in layered defenses)
Incident : cyber attack THE1692016092625
Incident Response Plan Activated: yes (front-end elements of cyber insurance utilized for immediate response)
Third Party Assistance: yes (technology space third parties via cyber insurance)
Remediation Measures: refining member and customer propositionstructural changes to the Food businessdisciplined approach to investment to manage cyber impact in H2 2025
Incident : ransomware THE4262142101725
Third Party Assistance: Digital Forensics Teams, Legal Counsel, It Recovery Experts (Via Cyber Insurance).
Recovery Measures: data backupsencryptionsecure storage practices
Communication Strategy: crisis communications (covered by cyber insurance)
Enhanced Monitoring: threat intelligencenetwork monitoring
Incident : Data Breach THE4993049103025
Communication Strategy: Public disclosure via Proton Data Breach Observatory; advisory to monitor accounts/bank statements
What is the company's incident response plan?
Incident Response Plan: The company's incident response plan is described as Yes (Restrictions Placed on Systems), Yes (systems temporarily shut down to contain threat), , , Yes (within minutes of detection), .
How does the company involve third-party assistance in incident response ?
Third-Party Assistance: The company involves third-party assistance in incident response through cybersecurity firms (e.g., NCC Group), threat intelligence providers, , , digital forensics teams, legal counsel, IT recovery experts (via cyber insurance), .
Data Breach Information
What type of data was compromised in each breach ?
Incident : Data Breach THE523050725
Type of Data Compromised: Names, Residential addresses, Email addresses, Phone numbers, Dates of birth
Data Exfiltration: Yes
Personally Identifiable Information: Yes
Incident : Data Breach, Ransomware THE411071725
Type of Data Compromised: Contact information
Number of Records Exposed: 6.5 million
Sensitivity of Data: High
Data Exfiltration: Yes
File Types Exposed: Windows NTDS.dit file
Personally Identifiable Information: Yes
Incident : ransomware THE1992019091025
Type of Data Compromised: Customer data, Pii, Payment information, Operational data
Sensitivity of Data: high (includes financial and personal data)
Data Exfiltration: likely (based on black market value of customer data)
Data Encryption: yes (ransomware attacks)
File Types Exposed: PDFs (weaponized)potentially databases, payment logs
Personally Identifiable Information: yes
Incident : ransomware THE2462024091125
Type of Data Compromised: Pii, Payment card data, Corporate emails, Supply chain data
Sensitivity of Data: high
Data Exfiltration: likely for black market sales
Data Encryption: ['by ransomware groups (e.g., Akira, Qilin)']
File Types Exposed: PDFsdatabasesfinancial records
Personally Identifiable Information: namesaddressespayment details
Incident : Cyber Attack THE5632356092525
Type of Data Compromised: Personal identifiable information (pii)
Number of Records Exposed: 6.5 million
Sensitivity of Data: Moderate (No Financial Data; PII Only)
Data Exfiltration: Yes (Names, Addresses, Contact Info)
Personally Identifiable Information: NamesAddressesContact Details
Incident : Cyberattack THE4932749092525
Type of Data Compromised: Personal data (members)
Number of Records Exposed: 6.5 million
Sensitivity of Data: High (personal identifiable information)
Data Exfiltration: Yes (copy of internal file created by hackers)
Personally Identifiable Information: Yes
Incident : Data Breach THE3892438092525
Type of Data Compromised: Personal data (members)
Number of Records Exposed: 6.5 million
Sensitivity of Data: High (personal information)
Incident : cyber attack THE1692016092625
Type of Data Compromised: Personally identifiable information (pii)
Number of Records Exposed: 6.5 million (member customers)
Sensitivity of Data: high
Data Exfiltration: yes (theft of personal data)
Personally Identifiable Information: yes
Incident : Data Breach THE4993049103025
Type of Data Compromised: Personally identifiable information (pii), Email addresses (100% of breaches), Names (90%), Phone numbers (72%), Passwords (49%), Health records (34%), Government records (34%)
Number of Records Exposed: 300+ million (verified breaches); hundreds of billions (including compilations)
Sensitivity of Data: Low (emails/names)Medium (phone numbers)High (passwords/health/gov records)
Data Exfiltration: Yes (dark web sales implied)
Personally Identifiable Information: Yes (dominant in all breaches)
What measures does the company take to prevent data exfiltration ?
Prevention of Data Exfiltration: The company takes the following measures to prevent data exfiltration: patching zero-day vulnerabilities, enhancing endpoint detection, updating PDF reader software, , Gradual System Restoration, Leadership Review, , Prioritized essential services (e.g., funerals, rural stores), Supported independent co-op societies and franchise partners, , System Restoration (Ongoing), Enhanced Monitoring, , refining member and customer proposition, structural changes to the Food business, disciplined approach to investment to manage cyber impact in H2 2025, .
How does the company handle incidents involving personally identifiable information (PII) ?
Handling of PII Incidents: The company handles incidents involving personally identifiable information (PII) through by taking multiple systems offline, engaging with the uk’s national cyber security centre (ncsc), , shut down several it systems, isolation of infected systems, disabling compromised accounts, blocking malicious ips, , system restrictions, blocked 4,000 ransomware attempts per minute, , shut down affected it systems, isolated compromised accounts, , partial shutdown of it systems, , temporary shutdown of it systems, prevented further ransomware deployment, , immediate account lockdown, malware blocking, layered cyber defenses and .
Ransomware Information
Was ransomware involved in any of the incidents ?
Incident : Data Breach, Ransomware THE411071725
Ransomware Strain: DragonForce
Data Encryption: Unknown
Data Exfiltration: Yes
Incident : ransomware THE1992019091025
Ransomware Strain: AkiraQilinPlayBabuk2
Data Encryption: yes
Data Exfiltration: likely (double extortion tactics common)
Incident : ransomware THE2462024091125
Ransomware Strain: AkiraQilinPlayBabuk2
Data Encryption: ['double extortion (encryption + exfiltration)']
Data Exfiltration: ['prior to encryption for leverage']
Incident : Cyber Attack THE5632356092525
Data Encryption: Attempted (Blocked by Defenses)
Data Exfiltration: Yes (PII Stolen Prior to Ransomware Attempt)
Incident : Cyberattack THE4932749092525
Data Encryption: No (attempted but failed)
Data Exfiltration: Yes
Incident : Data Breach THE3892438092525
Data Exfiltration: True
Incident : Cyber Attack THE1892618092525
Ransom Paid: No (attack was contained before ransomware deployment)
Data Encryption: Attempted (but blocked)
Incident : ransomware THE4262142101725
Ransomware Strain: DragonForce (Co-op)
How does the company recover data encrypted by ransomware ?
Data Recovery from Ransomware: The company recovers data encrypted by ransomware through restoring backups, rebuilding payment systems, customer notification campaigns, , Phased Reboot of IT Systems, Operational Adjustments in Food Business, , Resumed expansion plans (30 new openings in H2 2025), Overhauled leadership, Formed new commercial and logistics division, , Entered recovery phase after 2 weeks, Maintained trading during disruption, , Prioritized essential services (e.g., funerals), Stock prioritization for rural 'lifeline' stores, Support for independent co-op societies and franchise partners, £10 discount for members (on £40 shop), , Prioritization of Critical Services (e.g., Vulnerable Communities), Partnership with *The Hacking Games* to Address Root Causes, , data backups, encryption, secure storage practices, .
Regulatory Compliance
Were there any regulatory violations and fines imposed for each incident ?
Incident : ransomware THE2462024091125
Regulations Violated: GDPR (for UK/EU victims), PCI DSS (payment card breaches), sector-specific industrial regulations,
Regulatory Notifications: likely required for GDPR compliance
Incident : ransomware THE4262142101725
Regulations Violated: GDPR,
Fines Imposed: ['up to €20M or 4% global turnover']
Lessons Learned and Recommendations
What lessons were learned from each incident ?
Incident : ransomware THE1992019091025
Lessons Learned: Ransomware attacks are evolving toward high-value, targeted strikes despite overall decline in volume., Public disclosure by threat actors (e.g., Scattered Spider) increases pressure on victims and attracts copycats., Industrial and retail sectors remain prime targets due to operational disruption potential and data value., Weaponized PDFs and AI-enhanced phishing are emerging as critical attack vectors., Underreporting obscures the true scale of incidents; geopolitical/economic tensions exacerbate risks., Blurred lines between work/personal devices (e.g., remote work) create new vulnerabilities.
Incident : ransomware THE2462024091125
Lessons Learned: High-profile attacks in retail demonstrate the need for robust payment system segmentation., Zero-day exploits in PDF readers highlight the importance of patch management and behavioral monitoring., Public disclosure by threat actors (e.g., Scattered Spider) increases pressure on victims to pay ransoms., Geopolitical and economic instability correlates with increased cyberattack frequency and sophistication., AI-driven phishing and weaponized documents are evolving to bypass traditional security controls.
Incident : Cyber Attack THE5632356092525
Lessons Learned: Need for Strengthened Cyber Defenses Against Social Engineering, Importance of Rapid Containment to Limit Operational Disruption, Criticality of Member Data Protection, Resilience in Supply Chain and IT Systems
Incident : Cyberattack THE4932749092525
Lessons Learned: Need for stronger cybersecurity in food business operations, Importance of mandatory ransomware reporting (advocated by CEO), Resilience in maintaining essential services during crises, Opportunity to reflect and emerge stronger post-incident
Incident : Cyber Attack THE3433134092525
Lessons Learned: Highlighted strengths in financial resilience and colleague response, Identified need for improvements in Food business operations, Recognized cyber threats as a persistent risk requiring long-term mitigation, Emphasized structural changes and member/customer proposition refinement
Incident : Data Breach THE3892438092525
Lessons Learned: Highlighted strengths in balance sheet resilience and colleague response, Exposed vulnerabilities in food business operations, Need for structural changes and refined member/customer propositions
Incident : Cyber Attack THE1892618092525
Lessons Learned: Importance of layered cyber defenses and rapid response, Need for better insurance coverage against cyber risks, Addressing root causes like 'youth disenfranchisement' as a contributor to cyber threats, Focus on strengthening food business cybersecurity
Incident : cyber attack THE1692016092625
Lessons Learned: Highlighted strengths but also areas needing focus, particularly in the Food business., Need for refining member and customer proposition., Importance of structural changes to the business for long-term success., Disciplined investment approach to manage cyber impact.
Incident : ransomware THE4262142101725
Lessons Learned: Cyber insurance alone is insufficient without incident response capabilities., SMEs underestimate exposure, especially in supply chains or indirect data handling., Proactive cyber resilience (prevention, detection, response, recovery) is critical., Expert-led incident response reduces financial and operational impact., Regular updates to incident response plans and staff training improve readiness.
Incident : Data Breach THE4993049103025
Lessons Learned: Small businesses (under 250 employees) are disproportionately targeted despite limited resources to recover. Retail is the highest-risk industry. Basic PII (emails/names) is ubiquitous in breaches, but sensitive data (passwords/health records) poses severe identity theft risks. Continuous monitoring of accounts and breach notification tools (e.g., Have I Been Pwned) are critical for mitigation.
What recommendations were made to prevent future incidents ?
Incident : Data Breach THE523050725
Recommendations: Robust multi-factor authentication, Vigilant monitoring of privileged accounts, Rapid assimilation of threat intelligenceRobust multi-factor authentication, Vigilant monitoring of privileged accounts, Rapid assimilation of threat intelligenceRobust multi-factor authentication, Vigilant monitoring of privileged accounts, Rapid assimilation of threat intelligence
Incident : ransomware THE1992019091025
Recommendations: Strengthen security culture with regular training on phishing/social engineering (e.g., weaponized PDFs)., Prioritize patching zero-day vulnerabilities and unpatched systems., Implement network segmentation to limit lateral movement in industrial/retail environments., Develop and test incident response plans for ransomware, including communication strategies for public disclosures., Monitor dark web for stolen data (e.g., customer PII) and proactively notify affected parties., Adopt AI-driven threat detection to counter AI-enhanced attacks., Enforce strict separation of work/personal devices to reduce attack surfaces.Strengthen security culture with regular training on phishing/social engineering (e.g., weaponized PDFs)., Prioritize patching zero-day vulnerabilities and unpatched systems., Implement network segmentation to limit lateral movement in industrial/retail environments., Develop and test incident response plans for ransomware, including communication strategies for public disclosures., Monitor dark web for stolen data (e.g., customer PII) and proactively notify affected parties., Adopt AI-driven threat detection to counter AI-enhanced attacks., Enforce strict separation of work/personal devices to reduce attack surfaces.Strengthen security culture with regular training on phishing/social engineering (e.g., weaponized PDFs)., Prioritize patching zero-day vulnerabilities and unpatched systems., Implement network segmentation to limit lateral movement in industrial/retail environments., Develop and test incident response plans for ransomware, including communication strategies for public disclosures., Monitor dark web for stolen data (e.g., customer PII) and proactively notify affected parties., Adopt AI-driven threat detection to counter AI-enhanced attacks., Enforce strict separation of work/personal devices to reduce attack surfaces.Strengthen security culture with regular training on phishing/social engineering (e.g., weaponized PDFs)., Prioritize patching zero-day vulnerabilities and unpatched systems., Implement network segmentation to limit lateral movement in industrial/retail environments., Develop and test incident response plans for ransomware, including communication strategies for public disclosures., Monitor dark web for stolen data (e.g., customer PII) and proactively notify affected parties., Adopt AI-driven threat detection to counter AI-enhanced attacks., Enforce strict separation of work/personal devices to reduce attack surfaces.Strengthen security culture with regular training on phishing/social engineering (e.g., weaponized PDFs)., Prioritize patching zero-day vulnerabilities and unpatched systems., Implement network segmentation to limit lateral movement in industrial/retail environments., Develop and test incident response plans for ransomware, including communication strategies for public disclosures., Monitor dark web for stolen data (e.g., customer PII) and proactively notify affected parties., Adopt AI-driven threat detection to counter AI-enhanced attacks., Enforce strict separation of work/personal devices to reduce attack surfaces.Strengthen security culture with regular training on phishing/social engineering (e.g., weaponized PDFs)., Prioritize patching zero-day vulnerabilities and unpatched systems., Implement network segmentation to limit lateral movement in industrial/retail environments., Develop and test incident response plans for ransomware, including communication strategies for public disclosures., Monitor dark web for stolen data (e.g., customer PII) and proactively notify affected parties., Adopt AI-driven threat detection to counter AI-enhanced attacks., Enforce strict separation of work/personal devices to reduce attack surfaces.Strengthen security culture with regular training on phishing/social engineering (e.g., weaponized PDFs)., Prioritize patching zero-day vulnerabilities and unpatched systems., Implement network segmentation to limit lateral movement in industrial/retail environments., Develop and test incident response plans for ransomware, including communication strategies for public disclosures., Monitor dark web for stolen data (e.g., customer PII) and proactively notify affected parties., Adopt AI-driven threat detection to counter AI-enhanced attacks., Enforce strict separation of work/personal devices to reduce attack surfaces.
Incident : ransomware THE2462024091125
Recommendations: Implement **network segmentation** for payment and industrial control systems to limit lateral movement., Deploy **behavioral-based detection** (e.g., adaptive WAFs) to identify weaponized PDFs and zero-day exploits., Enhance **employee training** on AI-generated phishing and social engineering tactics., Establish **supply chain cybersecurity standards** to mitigate third-party risks., Adopt **proactive threat hunting** to detect ransomware groups like Akira and Scattered Spider early., Develop **incident response playbooks** tailored to ransomware and data exfiltration scenarios., Strengthen **customer communication plans** to maintain trust during breaches.Implement **network segmentation** for payment and industrial control systems to limit lateral movement., Deploy **behavioral-based detection** (e.g., adaptive WAFs) to identify weaponized PDFs and zero-day exploits., Enhance **employee training** on AI-generated phishing and social engineering tactics., Establish **supply chain cybersecurity standards** to mitigate third-party risks., Adopt **proactive threat hunting** to detect ransomware groups like Akira and Scattered Spider early., Develop **incident response playbooks** tailored to ransomware and data exfiltration scenarios., Strengthen **customer communication plans** to maintain trust during breaches.Implement **network segmentation** for payment and industrial control systems to limit lateral movement., Deploy **behavioral-based detection** (e.g., adaptive WAFs) to identify weaponized PDFs and zero-day exploits., Enhance **employee training** on AI-generated phishing and social engineering tactics., Establish **supply chain cybersecurity standards** to mitigate third-party risks., Adopt **proactive threat hunting** to detect ransomware groups like Akira and Scattered Spider early., Develop **incident response playbooks** tailored to ransomware and data exfiltration scenarios., Strengthen **customer communication plans** to maintain trust during breaches.Implement **network segmentation** for payment and industrial control systems to limit lateral movement., Deploy **behavioral-based detection** (e.g., adaptive WAFs) to identify weaponized PDFs and zero-day exploits., Enhance **employee training** on AI-generated phishing and social engineering tactics., Establish **supply chain cybersecurity standards** to mitigate third-party risks., Adopt **proactive threat hunting** to detect ransomware groups like Akira and Scattered Spider early., Develop **incident response playbooks** tailored to ransomware and data exfiltration scenarios., Strengthen **customer communication plans** to maintain trust during breaches.Implement **network segmentation** for payment and industrial control systems to limit lateral movement., Deploy **behavioral-based detection** (e.g., adaptive WAFs) to identify weaponized PDFs and zero-day exploits., Enhance **employee training** on AI-generated phishing and social engineering tactics., Establish **supply chain cybersecurity standards** to mitigate third-party risks., Adopt **proactive threat hunting** to detect ransomware groups like Akira and Scattered Spider early., Develop **incident response playbooks** tailored to ransomware and data exfiltration scenarios., Strengthen **customer communication plans** to maintain trust during breaches.Implement **network segmentation** for payment and industrial control systems to limit lateral movement., Deploy **behavioral-based detection** (e.g., adaptive WAFs) to identify weaponized PDFs and zero-day exploits., Enhance **employee training** on AI-generated phishing and social engineering tactics., Establish **supply chain cybersecurity standards** to mitigate third-party risks., Adopt **proactive threat hunting** to detect ransomware groups like Akira and Scattered Spider early., Develop **incident response playbooks** tailored to ransomware and data exfiltration scenarios., Strengthen **customer communication plans** to maintain trust during breaches.Implement **network segmentation** for payment and industrial control systems to limit lateral movement., Deploy **behavioral-based detection** (e.g., adaptive WAFs) to identify weaponized PDFs and zero-day exploits., Enhance **employee training** on AI-generated phishing and social engineering tactics., Establish **supply chain cybersecurity standards** to mitigate third-party risks., Adopt **proactive threat hunting** to detect ransomware groups like Akira and Scattered Spider early., Develop **incident response playbooks** tailored to ransomware and data exfiltration scenarios., Strengthen **customer communication plans** to maintain trust during breaches.
Incident : Cyber Attack THE5632356092525
Recommendations: Enhance Staff Training on Impersonation Attacks, Implement Multi-Factor Authentication (MFA) for Critical Systems, Conduct Third-Party Security Audits, Develop Redundant IT Infrastructure to Mitigate Downtime, Improve Incident Communication ProtocolsEnhance Staff Training on Impersonation Attacks, Implement Multi-Factor Authentication (MFA) for Critical Systems, Conduct Third-Party Security Audits, Develop Redundant IT Infrastructure to Mitigate Downtime, Improve Incident Communication ProtocolsEnhance Staff Training on Impersonation Attacks, Implement Multi-Factor Authentication (MFA) for Critical Systems, Conduct Third-Party Security Audits, Develop Redundant IT Infrastructure to Mitigate Downtime, Improve Incident Communication ProtocolsEnhance Staff Training on Impersonation Attacks, Implement Multi-Factor Authentication (MFA) for Critical Systems, Conduct Third-Party Security Audits, Develop Redundant IT Infrastructure to Mitigate Downtime, Improve Incident Communication ProtocolsEnhance Staff Training on Impersonation Attacks, Implement Multi-Factor Authentication (MFA) for Critical Systems, Conduct Third-Party Security Audits, Develop Redundant IT Infrastructure to Mitigate Downtime, Improve Incident Communication Protocols
Incident : Cyberattack THE4932749092525
Recommendations: Mandatory reporting of cyberattacks and ransom payments (CEO's call to UK Government), Enhanced employee training on social engineering and phishing, Improved segmentation of IT systems to limit lateral movement, Accelerated recovery plans for back-office operations, Customer retention strategies to rebuild trustMandatory reporting of cyberattacks and ransom payments (CEO's call to UK Government), Enhanced employee training on social engineering and phishing, Improved segmentation of IT systems to limit lateral movement, Accelerated recovery plans for back-office operations, Customer retention strategies to rebuild trustMandatory reporting of cyberattacks and ransom payments (CEO's call to UK Government), Enhanced employee training on social engineering and phishing, Improved segmentation of IT systems to limit lateral movement, Accelerated recovery plans for back-office operations, Customer retention strategies to rebuild trustMandatory reporting of cyberattacks and ransom payments (CEO's call to UK Government), Enhanced employee training on social engineering and phishing, Improved segmentation of IT systems to limit lateral movement, Accelerated recovery plans for back-office operations, Customer retention strategies to rebuild trustMandatory reporting of cyberattacks and ransom payments (CEO's call to UK Government), Enhanced employee training on social engineering and phishing, Improved segmentation of IT systems to limit lateral movement, Accelerated recovery plans for back-office operations, Customer retention strategies to rebuild trust
Incident : Cyber Attack THE3433134092525
Recommendations: Disciplined investment approach to bolster cyber defenses, Long-term focus on reducing cyber impact, Partnerships to address root causes of cyber threats (e.g., The Hacking Games initiative for youth disenfranchisement), Continuous refinement of business structure and member valueDisciplined investment approach to bolster cyber defenses, Long-term focus on reducing cyber impact, Partnerships to address root causes of cyber threats (e.g., The Hacking Games initiative for youth disenfranchisement), Continuous refinement of business structure and member valueDisciplined investment approach to bolster cyber defenses, Long-term focus on reducing cyber impact, Partnerships to address root causes of cyber threats (e.g., The Hacking Games initiative for youth disenfranchisement), Continuous refinement of business structure and member valueDisciplined investment approach to bolster cyber defenses, Long-term focus on reducing cyber impact, Partnerships to address root causes of cyber threats (e.g., The Hacking Games initiative for youth disenfranchisement), Continuous refinement of business structure and member value
Incident : Data Breach THE3892438092525
Recommendations: Refine member and customer propositions, Implement structural changes to the business, Long-term strategic adjustments for resilienceRefine member and customer propositions, Implement structural changes to the business, Long-term strategic adjustments for resilienceRefine member and customer propositions, Implement structural changes to the business, Long-term strategic adjustments for resilience
Incident : Cyber Attack THE1892618092525
Recommendations: Increase investment in proactive threat detection and response capabilities, Review and expand cyber insurance policies, Enhance employee training on social engineering tactics, Collaborate with initiatives like *The Hacking Games* to mitigate long-term cyber threatsIncrease investment in proactive threat detection and response capabilities, Review and expand cyber insurance policies, Enhance employee training on social engineering tactics, Collaborate with initiatives like *The Hacking Games* to mitigate long-term cyber threatsIncrease investment in proactive threat detection and response capabilities, Review and expand cyber insurance policies, Enhance employee training on social engineering tactics, Collaborate with initiatives like *The Hacking Games* to mitigate long-term cyber threatsIncrease investment in proactive threat detection and response capabilities, Review and expand cyber insurance policies, Enhance employee training on social engineering tactics, Collaborate with initiatives like *The Hacking Games* to mitigate long-term cyber threats
Incident : cyber attack THE1692016092625
Recommendations: Continue refining member and customer propositions., Implement structural changes in the Food business., Maintain a disciplined investment strategy to mitigate future cyber risks., Enhance cyber resilience measures to prevent similar incidents.Continue refining member and customer propositions., Implement structural changes in the Food business., Maintain a disciplined investment strategy to mitigate future cyber risks., Enhance cyber resilience measures to prevent similar incidents.Continue refining member and customer propositions., Implement structural changes in the Food business., Maintain a disciplined investment strategy to mitigate future cyber risks., Enhance cyber resilience measures to prevent similar incidents.Continue refining member and customer propositions., Implement structural changes in the Food business., Maintain a disciplined investment strategy to mitigate future cyber risks., Enhance cyber resilience measures to prevent similar incidents.
Incident : ransomware THE4262142101725
Recommendations: Invest in cyber insurance *and* cyber resilience strategies., Implement incident response planning with tested procedures., Adopt data management best practices (backups, encryption, secure storage)., Deploy proactive security measures (MFA, endpoint protection, threat intelligence)., Collaborate with external experts for rapid investigation and remediation., Conduct simulated breach exercises and regular plan reviews., Prioritize supply chain security and third-party risk management.Invest in cyber insurance *and* cyber resilience strategies., Implement incident response planning with tested procedures., Adopt data management best practices (backups, encryption, secure storage)., Deploy proactive security measures (MFA, endpoint protection, threat intelligence)., Collaborate with external experts for rapid investigation and remediation., Conduct simulated breach exercises and regular plan reviews., Prioritize supply chain security and third-party risk management.Invest in cyber insurance *and* cyber resilience strategies., Implement incident response planning with tested procedures., Adopt data management best practices (backups, encryption, secure storage)., Deploy proactive security measures (MFA, endpoint protection, threat intelligence)., Collaborate with external experts for rapid investigation and remediation., Conduct simulated breach exercises and regular plan reviews., Prioritize supply chain security and third-party risk management.Invest in cyber insurance *and* cyber resilience strategies., Implement incident response planning with tested procedures., Adopt data management best practices (backups, encryption, secure storage)., Deploy proactive security measures (MFA, endpoint protection, threat intelligence)., Collaborate with external experts for rapid investigation and remediation., Conduct simulated breach exercises and regular plan reviews., Prioritize supply chain security and third-party risk management.Invest in cyber insurance *and* cyber resilience strategies., Implement incident response planning with tested procedures., Adopt data management best practices (backups, encryption, secure storage)., Deploy proactive security measures (MFA, endpoint protection, threat intelligence)., Collaborate with external experts for rapid investigation and remediation., Conduct simulated breach exercises and regular plan reviews., Prioritize supply chain security and third-party risk management.Invest in cyber insurance *and* cyber resilience strategies., Implement incident response planning with tested procedures., Adopt data management best practices (backups, encryption, secure storage)., Deploy proactive security measures (MFA, endpoint protection, threat intelligence)., Collaborate with external experts for rapid investigation and remediation., Conduct simulated breach exercises and regular plan reviews., Prioritize supply chain security and third-party risk management.Invest in cyber insurance *and* cyber resilience strategies., Implement incident response planning with tested procedures., Adopt data management best practices (backups, encryption, secure storage)., Deploy proactive security measures (MFA, endpoint protection, threat intelligence)., Collaborate with external experts for rapid investigation and remediation., Conduct simulated breach exercises and regular plan reviews., Prioritize supply chain security and third-party risk management.
Incident : Data Breach THE4993049103025
Recommendations: Small businesses should prioritize cybersecurity hygiene (e.g., password managers, MFA)., Retailers must invest in threat detection and dark web monitoring., Consumers should use tools like Have I Been Pwned to check exposure and monitor financial accounts., Proactive communication strategies for breach disclosure to maintain trust.Small businesses should prioritize cybersecurity hygiene (e.g., password managers, MFA)., Retailers must invest in threat detection and dark web monitoring., Consumers should use tools like Have I Been Pwned to check exposure and monitor financial accounts., Proactive communication strategies for breach disclosure to maintain trust.Small businesses should prioritize cybersecurity hygiene (e.g., password managers, MFA)., Retailers must invest in threat detection and dark web monitoring., Consumers should use tools like Have I Been Pwned to check exposure and monitor financial accounts., Proactive communication strategies for breach disclosure to maintain trust.Small businesses should prioritize cybersecurity hygiene (e.g., password managers, MFA)., Retailers must invest in threat detection and dark web monitoring., Consumers should use tools like Have I Been Pwned to check exposure and monitor financial accounts., Proactive communication strategies for breach disclosure to maintain trust.
What are the key lessons learned from past incidents ?
Key Lessons Learned: The key lessons learned from past incidents are Ransomware attacks are evolving toward high-value, targeted strikes despite overall decline in volume.,Public disclosure by threat actors (e.g., Scattered Spider) increases pressure on victims and attracts copycats.,Industrial and retail sectors remain prime targets due to operational disruption potential and data value.,Weaponized PDFs and AI-enhanced phishing are emerging as critical attack vectors.,Underreporting obscures the true scale of incidents; geopolitical/economic tensions exacerbate risks.,Blurred lines between work/personal devices (e.g., remote work) create new vulnerabilities.High-profile attacks in retail demonstrate the need for robust payment system segmentation.,Zero-day exploits in PDF readers highlight the importance of patch management and behavioral monitoring.,Public disclosure by threat actors (e.g., Scattered Spider) increases pressure on victims to pay ransoms.,Geopolitical and economic instability correlates with increased cyberattack frequency and sophistication.,AI-driven phishing and weaponized documents are evolving to bypass traditional security controls.Need for Strengthened Cyber Defenses Against Social Engineering,Importance of Rapid Containment to Limit Operational Disruption,Criticality of Member Data Protection,Resilience in Supply Chain and IT SystemsNeed for stronger cybersecurity in food business operations,Importance of mandatory ransomware reporting (advocated by CEO),Resilience in maintaining essential services during crises,Opportunity to reflect and emerge stronger post-incidentHighlighted strengths in financial resilience and colleague response,Identified need for improvements in Food business operations,Recognized cyber threats as a persistent risk requiring long-term mitigation,Emphasized structural changes and member/customer proposition refinementHighlighted strengths in balance sheet resilience and colleague response,Exposed vulnerabilities in food business operations,Need for structural changes and refined member/customer propositionsImportance of layered cyber defenses and rapid response,Need for better insurance coverage against cyber risks,Addressing root causes like 'youth disenfranchisement' as a contributor to cyber threats,Focus on strengthening food business cybersecurityHighlighted strengths but also areas needing focus, particularly in the Food business.,Need for refining member and customer proposition.,Importance of structural changes to the business for long-term success.,Disciplined investment approach to manage cyber impact.Cyber insurance alone is insufficient without incident response capabilities.,SMEs underestimate exposure, especially in supply chains or indirect data handling.,Proactive cyber resilience (prevention, detection, response, recovery) is critical.,Expert-led incident response reduces financial and operational impact.,Regular updates to incident response plans and staff training improve readiness.Small businesses (under 250 employees) are disproportionately targeted despite limited resources to recover. Retail is the highest-risk industry. Basic PII (emails/names) is ubiquitous in breaches, but sensitive data (passwords/health records) poses severe identity theft risks. Continuous monitoring of accounts and breach notification tools (e.g., Have I Been Pwned) are critical for mitigation.
What recommendations has the company implemented to improve cybersecurity ?
Implemented Recommendations: The company has implemented the following recommendations to improve cybersecurity: Enhance employee training on social engineering tactics, Increase investment in proactive threat detection and response capabilities, Collaborate with initiatives like *The Hacking Games* to mitigate long-term cyber threats and Review and expand cyber insurance policies.
References
Where can I find more information about each incident ?
Incident : Cyberattack THE301062325
Source: Britain's Cyber Monitoring Centre (CMC)
Incident : Data Breach, Ransomware THE411071725
Source: BBC Breakfast show
Incident : Data Breach, Ransomware THE411071725
Source: BleepingComputer
Incident : ransomware THE1992019091025
Source: NCC Group Threat Intelligence
Incident : ransomware THE1992019091025
Source: Cybersecurity experts (e.g., Matt Hull, Mike)
Incident : ransomware THE2462024091125
Source: NCC Group Threat Intelligence Report
Date Accessed: 2024-05
Incident : ransomware THE2462024091125
Source: Cybersecurity Ventures - Ransomware Trends 2024
Date Accessed: 2024-05
Incident : Cyber Attack THE5632356092525
Source: The Telegraph
Incident : Cyber Attack THE5632356092525
Source: Co-op Group Financial Results (2023)
Incident : Cyberattack THE4932749092525
Source: The Independent
Incident : Cyberattack THE4932749092525
Source: PA News Agency (interview with CEO Shirine Khoury-Haq)
Incident : Cyber Attack THE3433134092525
Source: Co-op Group Half-Year Financial Report (2025)
Incident : Cyber Attack THE3433134092525
Source: Public Statements by Co-op Chair (Debbie White) and CEO (Shirine Khoury-Haq)
Incident : Data Breach THE3892438092525
Source: The Standard
Incident : Cyber Attack THE1892618092525
Source: The Mirror
Incident : cyber attack THE1692016092625
Source: Retail Insight Network (GlobalData)
Incident : ransomware THE4262142101725
Source: UK Government Survey 2025
Incident : ransomware THE4262142101725
Source: BlueVoyant Cyber Defense Platform
Where can stakeholders find additional resources on cybersecurity best practices ?
Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: Britain's Cyber Monitoring Centre (CMC), and Source: BBC Breakfast show, and Source: BleepingComputer, and Source: NCC Group Threat Intelligence, and Source: Cybersecurity experts (e.g., Matt Hull, Mike), and Source: NCC Group Threat Intelligence ReportDate Accessed: 2024-05, and Source: Cybersecurity Ventures - Ransomware Trends 2024Date Accessed: 2024-05, and Source: The Telegraph, and Source: Co-op Group Financial Results (2023), and Source: The Independent, and Source: PA News Agency (interview with CEO Shirine Khoury-Haq), and Source: Co-op Group Half-Year Financial Report (2025), and Source: Public Statements by Co-op Chair (Debbie White) and CEO (Shirine Khoury-Haq), and Source: The Standard, and Source: The Mirror, and Source: Retail Insight Network (GlobalData), and Source: UK Government Survey 2025, and Source: BlueVoyant Cyber Defense Platform, and Source: GDPR RegulationsUrl: https://gdpr-info.eu/, and Source: Proton Data Breach ObservatoryDate Accessed: 2025, and Source: TechRadar ProDate Accessed: 2025, and Source: Have I Been PwnedUrl: https://haveibeenpwned.com.
Investigation Status
What is the current status of the investigation for each incident ?
Incident : Data Breach THE523050725
Investigation Status: Ongoing
Incident : Data Breach, Ransomware THE411071725
Investigation Status: Ongoing
Incident : ransomware THE1992019091025
Investigation Status: ongoing (many incidents underreported or undisclosed)
Incident : ransomware THE2462024091125
Investigation Status: ongoing (many incidents under-reported)
Incident : Cyber Attack THE5632356092525
Investigation Status: Ongoing (Root Cause Attributed to Staff Impersonation)
Incident : Cyberattack THE4932749092525
Investigation Status: Ongoing (as of July 2025, recovery efforts continue)
Incident : Cyber Attack THE3433134092525
Investigation Status: Ongoing (as of July 2025, with long-term mitigation efforts planned)
Incident : Data Breach THE3892438092525
Investigation Status: Ongoing (as of July 2025 disclosure; further impacts expected in H2 2025)
Incident : Cyber Attack THE1892618092525
Investigation Status: Ongoing (as of July 2023, some systems still not fully restored)
Incident : Data Breach THE4993049103025
Investigation Status: Ongoing (Proton Observatory actively monitoring dark web)
How does the company communicate the status of incident investigations to stakeholders ?
Communication of Investigation Status: The company communicates the status of incident investigations to stakeholders through Notifying Affected Members, Public Apology By Ceo, Public Disclosure By Threat Actors (E.G., Scattered Spider), Expert Warnings About Underreporting, Limited Public Disclosure By Victims, Press Statements By Cybersecurity Experts, Advisories To Supply Chain Partners, Public Disclosure (July 2023), Ceo Apology, Transparency In Financial Reports, Public Disclosure In July 2025, Offered £10 Discount To Members As Compensation, Media Statements By Ceo And Chairwoman, Public Announcements On Financial Impact, Statements From Chair (Debbie White) And Ceo (Shirine Khoury-Haq), Emphasis On Colleague Resilience And Member Support, Public Disclosure In July 2025, Statements By Chairwoman (Debbie White) And Ceo (Shirine Khoury-Haq), Public Disclosure Of Financial Impact, Media Statements By Executives (E.G., Rob Elsey, Shirine Khoury-Haq), Crisis Communications (Covered By Cyber Insurance) and Public disclosure via Proton Data Breach Observatory; advisory to monitor accounts/bank statements.
Stakeholder and Customer Advisories
Were there any advisories issued to stakeholders or customers for each incident ?
Incident : ransomware THE1992019091025
Stakeholder Advisories: Retailers And Industrial Firms Urged To Heighten Defenses Against Ransomware And Supply Chain Attacks., Regulators Advised To Address Underreporting And Enforce Transparency In Breach Disclosures..
Customer Advisories: Customers of affected retailers (e.g., Co-op, M&S, Harrods) advised to monitor for identity theft and fraud.General public warned about phishing emails/PDFs impersonating trusted brands.
Incident : ransomware THE2462024091125
Stakeholder Advisories: Retailers Advised To Audit Payment System Security., Industrial Firms Urged To Isolate Ics From Corporate Networks., Regulators (E.G., Ico, Cisa) Monitoring Compliance With Breach Notifications..
Customer Advisories: Victims (e.g., Co-op, M&S) notified customers of potential PII exposure.Recommendations to monitor financial accounts for fraud.
Incident : Cyber Attack THE5632356092525
Stakeholder Advisories: Public Statements By Ceo And Chairman, Financial Disclosures To Investors.
Customer Advisories: CEO Apology for Data BreachAssurance No Financial Data Stolen
Incident : Cyberattack THE4932749092525
Stakeholder Advisories: Prioritized Support For Independent Co-Op Societies And Franchise Partners.
Customer Advisories: £10 discount off a £40 shop for members as compensation
Incident : Cyber Attack THE3433134092525
Stakeholder Advisories: Financial Impact Disclosed To Investors, Commitment To Long-Term Recovery Communicated To Members And Employees.
Customer Advisories: Assurance of continued service despite disruptionsFocus on supporting vulnerable communities during recovery
Incident : Data Breach THE3892438092525
Stakeholder Advisories: Public Statements By Leadership, Member Compensation (£10 Discount).
Customer Advisories: £10 discount for members on £40 shop as apology
Incident : Data Breach THE4993049103025
Stakeholder Advisories: Vigilance advised for all stakeholders; retailers urged to assess third-party risks.
Customer Advisories: Monitor bank statements/accounts for fraud; use breach notification tools.
What advisories does the company provide to stakeholders and customers following an incident ?
Advisories Provided: The company provides the following advisories to stakeholders and customers following an incident: were Retailers And Industrial Firms Urged To Heighten Defenses Against Ransomware And Supply Chain Attacks., Regulators Advised To Address Underreporting And Enforce Transparency In Breach Disclosures., Customers Of Affected Retailers (E.G., Co-Op, M&S, Harrods) Advised To Monitor For Identity Theft And Fraud., General Public Warned About Phishing Emails/Pdfs Impersonating Trusted Brands., , Retailers Advised To Audit Payment System Security., Industrial Firms Urged To Isolate Ics From Corporate Networks., Regulators (E.G., Ico, Cisa) Monitoring Compliance With Breach Notifications., Victims (E.G., Co-Op, M&S) Notified Customers Of Potential Pii Exposure., Recommendations To Monitor Financial Accounts For Fraud., , Public Statements By Ceo And Chairman, Financial Disclosures To Investors, Ceo Apology For Data Breach, Assurance No Financial Data Stolen, , Prioritized Support For Independent Co-Op Societies And Franchise Partners, £10 Discount Off A £40 Shop For Members As Compensation, , Financial Impact Disclosed To Investors, Commitment To Long-Term Recovery Communicated To Members And Employees, Assurance Of Continued Service Despite Disruptions, Focus On Supporting Vulnerable Communities During Recovery, , Public Statements By Leadership, Member Compensation (£10 Discount), £10 discount for members on £40 shop as apology, Vigilance advised for all stakeholders; retailers urged to assess third-party risks. and Monitor bank statements/accounts for fraud; use breach notification tools..
Initial Access Broker
How did the initial access broker gain entry for each incident ?
Incident : Data Breach, Ransomware THE411071725
Entry Point: Social engineering and password reset
High Value Targets: Windows Ntds.Dit File,
Data Sold on Dark Web: Windows Ntds.Dit File,
Incident : ransomware THE1992019091025
Entry Point: Weaponized Pdfs, Phishing Emails, Zero-Day Exploits,
High Value Targets: Retail Payment Systems, Industrial Operational Data, Customer Databases,
Data Sold on Dark Web: Retail Payment Systems, Industrial Operational Data, Customer Databases,
Incident : ransomware THE2462024091125
Entry Point: Weaponized Pdfs, Phishing Emails, Unpatched Software, Stolen Credentials,
Backdoors Established: ['likely in payment and supply chain systems']
High Value Targets: Retail Pos Systems, Industrial Control Networks, Customer Databases,
Data Sold on Dark Web: Retail Pos Systems, Industrial Control Networks, Customer Databases,
Incident : Cyber Attack THE5632356092525
Entry Point: Staff Impersonation
High Value Targets: Member Database, It Systems,
Data Sold on Dark Web: Member Database, It Systems,
Incident : Cyberattack THE4932749092525
Entry Point: Social engineering (impersonation of workers to trick employees)
High Value Targets: Member Data, It Systems Controlling Payments And Inventory,
Data Sold on Dark Web: Member Data, It Systems Controlling Payments And Inventory,
Incident : Data Breach THE3892438092525
High Value Targets: Member Database (6.5 Million Records),
Data Sold on Dark Web: Member Database (6.5 Million Records),
Incident : Cyber Attack THE1892618092525
Entry Point: Social Engineering (Impersonation of Employee)
Backdoors Established: Attempted (malware found but blocked)
Incident : ransomware THE4262142101725
Entry Point: Third-Party Access Control Vulnerability (Marks & Spencer),
Incident : Data Breach THE4993049103025
High Value Targets: Retail/wholesale traders; small businesses
Data Sold on Dark Web: Retail/wholesale traders; small businesses
Post-Incident Analysis
What were the root causes and corrective actions taken for each incident ?
Incident : Data Breach, Ransomware THE411071725
Root Causes: Weak Password Policies, Social Engineering Vulnerabilities,
Incident : ransomware THE1992019091025
Root Causes: Exploitation Of Zero-Day Vulnerabilities In Pdf Software., Successful Phishing/Social Engineering Due To Convincing Ai-Generated Content., Inadequate Patch Management And Unpatched Systems., Lack Of Network Segmentation In Retail/Industrial Environments., Blurred Work-Personal Device Boundaries Enabling Lateral Movement.,
Corrective Actions: Deploy Behavioral Analysis Tools To Detect Weaponized Pdfs/Malicious Attachments., Conduct Red Team Exercises To Test Resilience Against Ai-Enhanced Phishing., Enforce Multi-Factor Authentication (Mfa) For All Critical Systems., Isolate Payment Systems And Industrial Control Networks From General It Infrastructure., Establish A Cross-Sector Threat Intelligence Sharing Platform For Retail/Industrial Firms.,
Incident : ransomware THE2462024091125
Root Causes: Lack Of Segmentation Between Payment And Corporate Systems., Delayed Patching Of Zero-Day Vulnerabilities In Pdf Software., Insufficient Monitoring For Ai-Driven Phishing Campaigns., Over-Reliance On Perimeter Security Without Behavioral Detection.,
Corrective Actions: Mandatory **Mfa For All Critical Systems**., **Isolation Of Payment Environments** From General It Networks., **Continuous Vulnerability Scanning** For Zero-Day Exploits., **Dark Web Monitoring** For Stolen Credentials And Data Leaks., **Red Team Exercises** To Test Defenses Against Ransomware Tactics.,
Incident : Cyber Attack THE5632356092525
Root Causes: Successful Staff Impersonation By Attackers, Inadequate Safeguards Against Social Engineering, Rapid Propagation Of Malware Within Systems,
Corrective Actions: System Restrictions To Limit Attack Spread, Leadership Review (Md Resignation), Focus On Food Business Resilience,
Incident : Cyberattack THE4932749092525
Root Causes: Successful Phishing/Social Engineering Attack, Inadequate Employee Training On Impersonation Tactics, Lack Of System Segmentation To Contain Breach,
Corrective Actions: Leadership Overhaul And New Commercial/Logistics Division, Resumed Expansion With 30 New Store Openings In H2 2025, Advocacy For Government-Mandated Cyberattack Reporting,
Incident : Cyber Attack THE3433134092525
Corrective Actions: Refinement Of Member/Customer Proposition, Structural Changes To Business Operations (Especially Food Division), Partnership With The Hacking Games To Address Cyber Threat Roots, Financial Measures To Ensure Stability (E.G., £350M Lending Agreement, £400M Credit Facility),
Incident : Data Breach THE3892438092525
Root Causes: Sophisticated Attack (Specifics Undisclosed), It System Vulnerabilities Enabling Data Exfiltration,
Corrective Actions: Structural Business Changes, Refined Member/Customer Propositions, Long-Term Resilience Planning,
Incident : Cyber Attack THE1892618092525
Root Causes: Social Engineering Vulnerability (Employee Impersonation), Sophisticated, Persistent, And Multi-Staged Attack, Youth Disenfranchisement (Claimed As A Broader Root Cause By Co-Op Ceo),
Corrective Actions: Enhanced Monitoring And Layered Defenses, Partnership With *The Hacking Games* To Address Cyber Threat Roots, Focused Improvements In Food Business Cybersecurity,
Incident : cyber attack THE1692016092625
Corrective Actions: Refining Member And Customer Proposition., Structural Changes To The Food Business., Disciplined Investment Approach To Reduce Cyber Impact In H2 2025.,
Incident : ransomware THE4262142101725
Root Causes: Underestimation Of Risk (Especially Smes In Supply Chains)., Lack Of Cyber Insurance Coverage (E.G., Co-Op For Ransomware)., Inadequate Incident Response Capabilities., Third-Party Vulnerabilities (E.G., Access Control In Marks & Spencer).,
Corrective Actions: Integrate Cyber Insurance With Cyber Resilience Strategies., Enhance Third-Party/Supply Chain Security Assessments., Implement And Test Incident Response Plans., Invest In Expert-Led Forensics And Recovery Services., Regularly Update Security Measures (Mfa, Monitoring, Threat Intelligence).,
Incident : Data Breach THE4993049103025
Root Causes: Targeting Of Under-Resourced Small Businesses, High-Value Pii Collection By Retailers, Lack Of Proportional Cybersecurity Investments In Smes,
What is the company's process for conducting post-incident analysis ?
Post-Incident Analysis Process: The company's process for conducting post-incident analysis is described as Cybersecurity Firms (E.G., Ncc Group), Threat Intelligence Providers, , For Weaponized Pdfs, Ai-Generated Phishing Attempts, , Yes (continuous investment in layered defenses), , Digital Forensics Teams, Legal Counsel, It Recovery Experts (Via Cyber Insurance), , Threat Intelligence, Network Monitoring, .
What corrective actions has the company taken based on post-incident analysis ?
Corrective Actions Taken: The company has taken the following corrective actions based on post-incident analysis: Deploy Behavioral Analysis Tools To Detect Weaponized Pdfs/Malicious Attachments., Conduct Red Team Exercises To Test Resilience Against Ai-Enhanced Phishing., Enforce Multi-Factor Authentication (Mfa) For All Critical Systems., Isolate Payment Systems And Industrial Control Networks From General It Infrastructure., Establish A Cross-Sector Threat Intelligence Sharing Platform For Retail/Industrial Firms., , Mandatory **Mfa For All Critical Systems**., **Isolation Of Payment Environments** From General It Networks., **Continuous Vulnerability Scanning** For Zero-Day Exploits., **Dark Web Monitoring** For Stolen Credentials And Data Leaks., **Red Team Exercises** To Test Defenses Against Ransomware Tactics., , System Restrictions To Limit Attack Spread, Leadership Review (Md Resignation), Focus On Food Business Resilience, , Leadership Overhaul And New Commercial/Logistics Division, Resumed Expansion With 30 New Store Openings In H2 2025, Advocacy For Government-Mandated Cyberattack Reporting, , Refinement Of Member/Customer Proposition, Structural Changes To Business Operations (Especially Food Division), Partnership With The Hacking Games To Address Cyber Threat Roots, Financial Measures To Ensure Stability (E.G., £350M Lending Agreement, £400M Credit Facility), , Structural Business Changes, Refined Member/Customer Propositions, Long-Term Resilience Planning, , Enhanced Monitoring And Layered Defenses, Partnership With *The Hacking Games* To Address Cyber Threat Roots, Focused Improvements In Food Business Cybersecurity, , Refining Member And Customer Proposition., Structural Changes To The Food Business., Disciplined Investment Approach To Reduce Cyber Impact In H2 2025., , Integrate Cyber Insurance With Cyber Resilience Strategies., Enhance Third-Party/Supply Chain Security Assessments., Implement And Test Incident Response Plans., Invest In Expert-Led Forensics And Recovery Services., Regularly Update Security Measures (Mfa, Monitoring, Threat Intelligence)., .
Additional Questions
General Information
Has the company ever paid ransoms ?
Ransom Payment History: The company has Paid ransoms in the past.
Who was the attacking group in the last incident ?
Last Attacking Group: The attacking group in the last incident were an Scattered Spider, AkiraScattered SpiderQilinPlayBabuk2, AkiraScattered SpiderQilinPlayBabuk2, Unknown (Described as 'very persistent and very capable' criminals) and DragonForce (Co-op ransomware).
Incident Details
What was the most recent incident detected ?
Most Recent Incident Detected: The most recent incident detected was on 2023-04-22.
What was the most recent incident publicly disclosed ?
Most Recent Incident Publicly Disclosed: The most recent incident publicly disclosed was on 2025.
Impact of the Incidents
What was the highest financial loss from an incident ?
Highest Financial Loss: The highest financial loss from an incident was £300 million (estimated for UK retailers like Coop and M&S).
What was the most significant data compromised in an incident ?
Most Significant Data Compromised: The most significant data compromised in an incident were names, residential addresses, email addresses, phone numbers, dates of birth, , Contact information of 6.5 million members, , customer data, payment system information, personally identifiable information (PII), , customer payment data, personally identifiable information (PII), corporate intellectual property, Records Exposed: 6.5 million (members' data), Data Types: ['Names', 'Addresses', 'Contact Information'], , Records Exposed: 6.5 million (members' data), Data Types: ['Names', 'Addresses', 'Contact Information'], , Personal data of all 6.5 million members, Personal data of 6.5 million members (file copied by hackers)Personal Data: {'customers_affected': '6.5 million (member customers)', 'type': ['personally identifiable information (PII)']}, , Personal Data: {'customers_affected': '6.5 million (member customers)', 'type': ['personally identifiable information (PII)']}, and 300+ million individual records (800 verified breaches); hundreds of billions including compilations.
What was the most significant system affected in an incident ?
Most Significant System Affected: The most significant system affected in an incident was IT systemsWindows domain and payment systemsoperational infrastructuresupply chain networks and payment processing systemsretail POS terminalsindustrial control systems (ICS)supply chain management platforms and IT Systems (Shutdown)Food Delivery SystemsMember Database and IT systems (partially shut down)Payment systemsInventory managementBack-office operations and IT Systems (partial shutdown)Supply Chain Systems and IT systems (partially shut down)Payment systemsInventory management and Operational Systems (Partial Downtime)Sales Systems and IT systems (retailer)payment systemsinventory management systemsfuneral home operations (reverted to paper-based).
Response to the Incidents
What third-party assistance was involved in the most recent incident ?
Third-Party Assistance in Most Recent Incident: The third-party assistance involved in the most recent incident was cybersecurity firms (e.g., ncc group), threat intelligence providers, , , digital forensics teams, legal counsel, it recovery experts (via cyber insurance), .
What containment measures were taken in the most recent incident ?
Containment Measures in Most Recent Incident: The containment measures taken in the most recent incident were Taking multiple systems offlineEngaging with the UK’s National Cyber Security Centre (NCSC), Shut down several IT systems, isolation of infected systemsdisabling compromised accountsblocking malicious IPs, System RestrictionsBlocked 4,000 Ransomware Attempts per Minute, Shut down affected IT systemsIsolated compromised accounts, Partial shutdown of IT systems, Temporary shutdown of IT systemsPrevented further ransomware deployment and Immediate Account LockdownMalware BlockingLayered Cyber Defenses.
Data Breach Information
What was the most sensitive data compromised in a breach ?
Most Sensitive Data Compromised: The most sensitive data compromised in a breach were customer payment data, names, phone numbers, corporate intellectual property, Personal data of all 6.5 million members, Personal data of 6.5 million members (file copied by hackers), personally identifiable information (PII), email addresses, dates of birth, Contact information of 6.5 million members, 300+ million individual records (800 verified breaches); hundreds of billions including compilations, residential addresses, payment system information and customer data.
What was the number of records exposed in the most significant breach ?
Number of Records Exposed in Most Significant Breach: The number of records exposed in the most significant breach was 32.5M.
Ransomware Information
What was the highest ransom paid in a ransomware incident ?
Highest Ransom Paid: The highest ransom paid in a ransomware incident was No (attack was contained before ransomware deployment).
Regulatory Compliance
What was the highest fine imposed for a regulatory violation ?
Highest Fine Imposed: The highest fine imposed for a regulatory violation was up to €20M or 4% global turnover, .
Lessons Learned and Recommendations
What was the most significant lesson learned from past incidents ?
Most Significant Lesson Learned: The most significant lesson learned from past incidents was Regular updates to incident response plans and staff training improve readiness., Small businesses (under 250 employees) are disproportionately targeted despite limited resources to recover. Retail is the highest-risk industry. Basic PII (emails/names) is ubiquitous in breaches, but sensitive data (passwords/health records) poses severe identity theft risks. Continuous monitoring of accounts and breach notification tools (e.g., Have I Been Pwned) are critical for mitigation.
What was the most significant recommendation implemented to improve cybersecurity ?
Most Significant Recommendation Implemented: The most significant recommendation implemented to improve cybersecurity was Accelerated recovery plans for back-office operations, Deploy proactive security measures (MFA, endpoint protection, threat intelligence)., Develop and test incident response plans for ransomware, including communication strategies for public disclosures., Adopt **proactive threat hunting** to detect ransomware groups like Akira and Scattered Spider early., Enhance cyber resilience measures to prevent similar incidents., Develop Redundant IT Infrastructure to Mitigate Downtime, Consumers should use tools like Have I Been Pwned to check exposure and monitor financial accounts., Prioritize patching zero-day vulnerabilities and unpatched systems., Continue refining member and customer propositions., Refine member and customer propositions, Enhance employee training on social engineering tactics, Invest in cyber insurance *and* cyber resilience strategies., Enhance **employee training** on AI-generated phishing and social engineering tactics., Implement **network segmentation** for payment and industrial control systems to limit lateral movement., Partnerships to address root causes of cyber threats (e.g., The Hacking Games initiative for youth disenfranchisement), Mandatory reporting of cyberattacks and ransom payments (CEO's call to UK Government), Deploy **behavioral-based detection** (e.g., adaptive WAFs) to identify weaponized PDFs and zero-day exploits., Collaborate with external experts for rapid investigation and remediation., Long-term strategic adjustments for resilience, Maintain a disciplined investment strategy to mitigate future cyber risks., Review and expand cyber insurance policies, Enhance Staff Training on Impersonation Attacks, Customer retention strategies to rebuild trust, Adopt AI-driven threat detection to counter AI-enhanced attacks., Strengthen security culture with regular training on phishing/social engineering (e.g., weaponized PDFs)., Increase investment in proactive threat detection and response capabilities, Implement incident response planning with tested procedures., Implement network segmentation to limit lateral movement in industrial/retail environments., Proactive communication strategies for breach disclosure to maintain trust., Implement structural changes to the business, Small businesses should prioritize cybersecurity hygiene (e.g., password managers, MFA)., Implement structural changes in the Food business., Vigilant monitoring of privileged accounts, Prioritize supply chain security and third-party risk management., Long-term focus on reducing cyber impact, Monitor dark web for stolen data (e.g., customer PII) and proactively notify affected parties., Establish **supply chain cybersecurity standards** to mitigate third-party risks., Rapid assimilation of threat intelligence, Enforce strict separation of work/personal devices to reduce attack surfaces., Improved segmentation of IT systems to limit lateral movement, Disciplined investment approach to bolster cyber defenses, Retailers must invest in threat detection and dark web monitoring., Implement Multi-Factor Authentication (MFA) for Critical Systems, Robust multi-factor authentication, Collaborate with initiatives like *The Hacking Games* to mitigate long-term cyber threats, Continuous refinement of business structure and member value, Enhanced employee training on social engineering and phishing, Strengthen **customer communication plans** to maintain trust during breaches., Improve Incident Communication Protocols, Develop **incident response playbooks** tailored to ransomware and data exfiltration scenarios., Conduct simulated breach exercises and regular plan reviews., Adopt data management best practices (backups, encryption, secure storage). and Conduct Third-Party Security Audits.
References
What is the most recent source of information about an incident ?
Most Recent Source: The most recent source of information about an incident are Proton Data Breach Observatory, TechRadar Pro, NCC Group Threat Intelligence, BleepingComputer, GDPR Regulations, BBC Breakfast show, NCC Group Threat Intelligence Report, Cybersecurity experts (e.g., Matt Hull, Mike), Retail Insight Network (GlobalData), The Telegraph, Britain's Cyber Monitoring Centre (CMC), Public Statements by Co-op Chair (Debbie White) and CEO (Shirine Khoury-Haq), Cybersecurity Ventures - Ransomware Trends 2024, Have I Been Pwned, The Standard, The Independent, PA News Agency (interview with CEO Shirine Khoury-Haq), UK Government Survey 2025, The Mirror, BlueVoyant Cyber Defense Platform, Co-op Group Half-Year Financial Report (2025) and Co-op Group Financial Results (2023).
What is the most recent URL for additional resources on cybersecurity best practices ?
Most Recent URL for Additional Resources: The most recent URL for additional resources on cybersecurity best practices is https://gdpr-info.eu/, https://haveibeenpwned.com .
Investigation Status
What is the current status of the most recent investigation ?
Current Status of Most Recent Investigation: The current status of the most recent investigation is Ongoing.
Stakeholder and Customer Advisories
What was the most recent stakeholder advisory issued ?
Most Recent Stakeholder Advisory: The most recent stakeholder advisory issued was Retailers and industrial firms urged to heighten defenses against ransomware and supply chain attacks., Regulators advised to address underreporting and enforce transparency in breach disclosures., Retailers advised to audit payment system security., Industrial firms urged to isolate ICS from corporate networks., Regulators (e.g., ICO, CISA) monitoring compliance with breach notifications., Public Statements by CEO and Chairman, Financial Disclosures to Investors, Prioritized support for independent co-op societies and franchise partners, Financial impact disclosed to investors, Commitment to long-term recovery communicated to members and employees, Public statements by leadership, Member compensation (£10 discount), Vigilance advised for all stakeholders; retailers urged to assess third-party risks., .
What was the most recent customer advisory issued ?
Most Recent Customer Advisory: The most recent customer advisory issued were an Customers of affected retailers (e.g., Co-op, M&S, Harrods) advised to monitor for identity theft and fraud.General public warned about phishing emails/PDFs impersonating trusted brands., Victims (e.g., Co-op, M&S) notified customers of potential PII exposure.Recommendations to monitor financial accounts for fraud., CEO Apology for Data BreachAssurance No Financial Data Stolen, £10 discount off a £40 shop for members as compensation, Assurance of continued service despite disruptionsFocus on supporting vulnerable communities during recovery, £10 discount for members on £40 shop as apology and Monitor bank statements/accounts for fraud; use breach notification tools.
Initial Access Broker
What was the most recent entry point used by an initial access broker ?
Most Recent Entry Point: The most recent entry point used by an initial access broker were an Staff Impersonation, Social Engineering (Impersonation of Employee), Social engineering and password reset and Social engineering (impersonation of workers to trick employees).
Post-Incident Analysis
What was the most significant root cause identified in post-incident analysis ?
Most Significant Root Cause: The most significant root cause identified in post-incident analysis was Weak password policiesSocial engineering vulnerabilities, Exploitation of zero-day vulnerabilities in PDF software.Successful phishing/social engineering due to convincing AI-generated content.Inadequate patch management and unpatched systems.Lack of network segmentation in retail/industrial environments.Blurred work-personal device boundaries enabling lateral movement., Lack of segmentation between payment and corporate systems.Delayed patching of zero-day vulnerabilities in PDF software.Insufficient monitoring for AI-driven phishing campaigns.Over-reliance on perimeter security without behavioral detection., Successful Staff Impersonation by AttackersInadequate Safeguards Against Social EngineeringRapid Propagation of Malware Within Systems, Successful phishing/social engineering attackInadequate employee training on impersonation tacticsLack of system segmentation to contain breach, Sophisticated attack (specifics undisclosed)IT system vulnerabilities enabling data exfiltration, Social Engineering Vulnerability (Employee Impersonation)Sophisticated, Persistent, and Multi-Staged AttackYouth disenfranchisement (claimed as a broader root cause by Co-op CEO), Underestimation of risk (especially SMEs in supply chains).Lack of cyber insurance coverage (e.g., Co-op for ransomware).Inadequate incident response capabilities.Third-party vulnerabilities (e.g., access control in Marks & Spencer)., Targeting of under-resourced small businessesHigh-value PII collection by retailersLack of proportional cybersecurity investments in SMEs.
What was the most significant corrective action taken based on post-incident analysis ?
Most Significant Corrective Action: The most significant corrective action taken based on post-incident analysis was Deploy behavioral analysis tools to detect weaponized PDFs/malicious attachments.Conduct red team exercises to test resilience against AI-enhanced phishing.Enforce multi-factor authentication (MFA) for all critical systems.Isolate payment systems and industrial control networks from general IT infrastructure.Establish a cross-sector threat intelligence sharing platform for retail/industrial firms., Mandatory **MFA for all critical systems**.**Isolation of payment environments** from general IT networks.**Continuous vulnerability scanning** for zero-day exploits.**Dark web monitoring** for stolen credentials and data leaks.**Red team exercises** to test defenses against ransomware tactics., System Restrictions to Limit Attack SpreadLeadership Review (MD Resignation)Focus on Food Business Resilience, Leadership overhaul and new commercial/logistics divisionResumed expansion with 30 new store openings in H2 2025Advocacy for government-mandated cyberattack reporting, Refinement of member/customer propositionStructural changes to business operations (especially Food division)Partnership with The Hacking Games to address cyber threat rootsFinancial measures to ensure stability (e.g., £350m lending agreement, £400m credit facility), Structural business changesRefined member/customer propositionsLong-term resilience planning, Enhanced monitoring and layered defensesPartnership with *The Hacking Games* to address cyber threat rootsFocused improvements in food business cybersecurity, Refining member and customer proposition.Structural changes to the Food business.Disciplined investment approach to reduce cyber impact in H2 2025., Integrate cyber insurance with cyber resilience strategies.Enhance third-party/supply chain security assessments.Implement and test incident response plans.Invest in expert-led forensics and recovery services.Regularly update security measures (MFA, monitoring, threat intelligence)..
.png)
Latest Global CVEs (Not Company-Specific)
Description
Exposure of credentials in unintended requests in Devolutions Server, Remote Desktop Manager on Windows.This issue affects Devolutions Server: through 2025.3.8.0; Remote Desktop Manager: through 2025.3.23.0.
Risk Information
cvss3
Base: 6.5
Severity: LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Description
Out-of-bounds memory operations in org.lz4:lz4-java 1.8.0 and earlier allow remote attackers to cause denial of service and read adjacent memory via untrusted compressed input.
Risk Information
cvss4
Base: 8.8
Severity: LOW
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Description
Reveals plaintext credentials in the MONITOR command vulnerability in Apache Kvrocks. This issue affects Apache Kvrocks: from 1.0.0 through 2.13.0. Users are recommended to upgrade to version 2.14.0, which fixes the issue.
Risk Information
cvss3
Base: 5.3
Severity: LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Description
Improper Privilege Management vulnerability in Apache Kvrocks. This issue affects Apache Kvrocks: from v2.9.0 through v2.13.0. Users are recommended to upgrade to version 2.14.0, which fixes the issue.
Risk Information
cvss3
Base: 5.4
Severity: LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Description
File upload vulnerability in HCL Technologies Ltd. Unica 12.0.0.
Risk Information
cvss3
Base: 6.3
Severity: LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Access Data Using Our API
Get company history
curl -i -X GET 'https://api.rankiteo.com/underwriter-getcompany-history?linkedin_id=the-co-op-group' -H 'apikey: YOUR_API_KEY_HERE'
RapidWhat Do We Measure ?
Incident
Finding
Grade
Digital Assets
Every week, Rankiteo analyzes billions of signals to give organizations a sharper, faster view of emerging risks. With deeper, more actionable intelligence at their fingertips, security teams can outpace threat actors, respond instantly to Zero-Day attacks, and dramatically shrink their risk exposure window.
These are some of the factors we use to calculate the overall score:
Network Security
Identify exposed access points, detect misconfigured SSL certificates, and uncover vulnerabilities across the network infrastructure.
SBOM (Software Bill of Materials)
Gain visibility into the software components used within an organization to detect vulnerabilities, manage risk, and ensure supply chain security.
CMDB (Configuration Management Database)
Monitor and manage all IT assets and their configurations to ensure accurate, real-time visibility across the company's technology environment.
Threat Intelligence
Leverage real-time insights on active threats, malware campaigns, and emerging vulnerabilities to proactively defend against evolving cyberattacks.
Rankiteo is a unified scoring and risk platform that analyzes billions of signals weekly to help organizations gain faster, more actionable insights into emerging threats. Empowering teams to outpace adversaries and reduce exposure.
