Loading story…
The Co-operative Group, a major British retailer, suffered a significant cyberattack in April that severely disrupted its operations and led to substantial financial losses. The attack forced the company to shut down parts of its IT systems, resulting in empty shelves and supply chain disruptions across its food retail business. Co-op reported a £206 million loss in revenue, with an £80 million hit to profits in the first half of 2025, marking a sharp reversal from the previous year's profit. The incident also triggered a one-off payment of £20 million, the purpose of which has not been publicly explained. Despite the company's efforts to contain the attack by proactively taking systems offline, the attackers managed to steal the personal details of all 6.5 million Co-op members, including names and contact information, though payment card and transaction data were reportedly not compromised. The breach led to weeks of operational chaos, with back-office functions seizing up and the company having to offer significant discounts to lure customers back. The Information Commissioner's Office is expected to investigate the exposure of such a large volume of personal data. Four individuals, including a minor, were arrested in July in connection with the hacks on Co-op and other UK retailers, with the attackers believed to have ties to the Scattered Spider cybercriminal group. Co-op's CEO, Shirine Khoury-Haq, stated that staff worked around the clock to restore operations and protect systems, and credited the company's structure for its resilience. The company managed to avoid a full-scale ransomware lockdown by disconnecting its networks, but the disruption still allowed competitors to take market share. The attack was part of a broader wave of cyber incidents affecting major UK retailers in the spring, including Marks & Spencer and Harrods. The financial impact of the attack was so severe that Co-op reported an underlying operating loss of £32 million, compared to a £47 million profit the previous year. The company has not confirmed whether a ransom was paid, and has not responded to media requests for further comment. The breach has raised concerns about the security of member data and the robustness of Co-op's cyber defenses. The incident underscores the growing threat of cyberattacks to critical retail infrastructure and the potential for widespread operational and financial damage.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
Co-op reported that the April cyberattack shaved about £206 million from revenue and caused an £80 million hit to profit, contributing to an underlying operating loss in the first half of 2025. The company said the attack's operational and financial effects were significant.
The UK Cyber Monitoring Centre categorized the Co-op and M&S cyber incidents as a Category 2 systemic event. It estimated combined losses from the attacks at £270 million to £440 million.
In July 2025, the UK National Crime Agency arrested four young suspects in connection with cyberattacks targeting Co-op, Marks & Spencer, and Harrods. Reporting linked the suspects to activity associated with Scattered Spider.
Co-op later confirmed that current and former member data had been accessed in the incident, affecting 6.5 million members. The exposed data included names, contact details, and dates of birth, but not passwords, payment card or bank details, or transaction data.
The cybercrime group calling itself DragonForce told the BBC it was responsible for the Co-op attack and said it had stolen member data. The group provided screenshots and other proof to support its claim.
After the attack became public, Co-op first stated it had no evidence that customer data had been compromised. This position was later revised as the investigation progressed.
In April 2025, Co-op suffered a major cyberattack that disrupted back-office systems and supply chains, causing empty shelves and stock shortages for weeks. The company said it disconnected networks to prevent a full ransomware lockdown.
An extortion message tied to the Co-op intrusion was sent through Microsoft Teams, with screenshots later cited by the threat group as proof of access. This indicates the attack was active by that date.
8 references tracked. Mallory keeps watching after this page renders.
theguardian.com
Open sourceinfosecurity-magazine.com
Open sourcesecurityaffairs.com
Open sourcego.theregister.com
Open sourcetherecord.media
Open sourcetechcrunch.com
Open sourcetheregister.com
Open sourcebbc.co.uk
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Marks & Spencer said a cyberattack exposed customer personal data and caused prolonged disruption across its retail operations, including suspended online orders, store outages, delivery problems, and empty grocery shelves. The company said stolen information included names, dates of birth, home and email addresses, phone numbers, household details, and online order histories, prompting password resets for online accounts. UK authorities, including the National Cyber Security Centre, worked with affected retailers and law enforcement as the fallout spread beyond M&S. The attack has been linked in reporting to **Scattered Spider** and the **DragonForce** ransomware and extortion operation, with **Co-op** and **Harrods** also reported as targets around the same period. M&S later said the intrusion began through a contractor compromised via sophisticated social engineering rather than exploitation of a flaw in its own systems, and warned the impact would continue for months. The retailer estimated the incident would cut profits by about **£300 million**, with some losses expected to be offset through insurance and other recovery measures.
Jun 29, 2026
Harrods, the renowned London-based luxury retailer, has confirmed a significant data breach affecting 430,000 of its customers after a third-party supplier was compromised by cybercriminals. The company began notifying affected customers on September 26, informing them that their personal data had been accessed during the supplier breach. The stolen data includes basic personal details such as names and contact information, but does not encompass passwords or financial data, according to Harrods' official statements. Some records also contained marketing-related information, including Harrods membership tier levels and affiliations with co-branded cards, though the retailer believes this information would be difficult for unauthorized parties to interpret accurately. Harrods emphasized that its own internal systems were not targeted or compromised in the incident, and the breach was isolated to the unnamed third-party provider. The company has received direct communications from the threat actor responsible for the breach but has stated it will not engage with them. Harrods has reported the incident to all relevant authorities and is cooperating fully with ongoing investigations. The retailer has also reassured customers that the incident is unrelated to a previous cyberattack earlier in the year, which was attributed to the Scattered Spider group. In that earlier event, Harrods successfully blocked the attackers from accessing its systems, while other retailers such as Marks and Spencer and Co-op were also targeted. The current breach was first reported by UK media outlets after Harrods began customer notifications. The company operates a comprehensive e-commerce platform serving international customers, making the exposure of customer data particularly concerning. Harrods has not disclosed the identity of the compromised supplier, citing ongoing investigations and containment efforts. The company’s focus remains on supporting affected customers and maintaining transparency throughout the incident response process. No evidence has been presented to suggest that the compromised data has been used for fraudulent purposes at this time. Harrods has reiterated its commitment to data security and is reviewing its relationships with third-party suppliers to prevent similar incidents in the future. The breach highlights the ongoing risks associated with supply chain security in the retail sector. Customers have been advised to remain vigilant for potential phishing attempts or scams leveraging their exposed information. The incident underscores the importance of robust third-party risk management and timely communication with affected stakeholders.
Jun 29, 2026
Marks & Spencer suffered a significant cyberattack in April that resulted in extensive operational disruption and a dramatic impact on its financial performance. The retailer reported that the incident led to a 55.4% drop in profits, with first-half earnings plunging to £3.4 million ($4.4 million) from £391.1 million ($510 million) the previous year. The attack forced the company to disconnect its warehouse management and online ordering systems, halting online and international sales for weeks. Home delivery resumed in June, and 'click and collect' services were restored in August, but sales in key departments such as fashion, home, and beauty declined by 16.4% during the reporting period due to the disruption. The total cost of the cyberattack is estimated at £136 million ($177.2 million), with £83 million ($108.2 million) spent on immediate response and recovery, and the remainder on legal and professional services. Marks & Spencer expects to offset much of these costs with a £100 million ($130.4 million) insurance claim. The incident is believed to be linked to the Scattered Spider hacking collective, with several arrests made in connection to this and other attacks on UK retailers. Despite the setback, M&S reported a 22.1% increase in overall revenues, though the cyberattack's impact on profits and operations was substantial.
Jul 12, 2026