Co-op Apologizes to 6.5 Million Members Affected in Cyberattack

The CEO of Co‑operative Group Limited, Shirine Khoury-Haq, admitted that 6.5 million members of its internal system had their data stolen during a recent cyberattack. She apologized during an interview with the BBC on Wednesday.

According to the statements shared by the BBC, Khoury-Haq confirmed that hackers linked to the DragonForce ransomware group — who have also targeted Marks & Spencer and other retailers — accessed the personal information of all members of the Co-op membership program.

"I'm devastated that information was taken,” said Khoury-Haq. “I'm also devastated by the impact that it took on our colleagues, as well as they tried to contain all of this."

The CEO clarified that while sensitive data such as names, addresses, and contact details were lost in the hack, the user’s financial data was not exposed. She said she was "incredibly sorry" for the attack and the resulting data breach, and that the company’s IT staff were doing everything they could to fight off the criminals.

The hackers no longer have access to Co-op’s systems, but left traces that the company workers have shared with the authorities as part of the investigation. The company has also partnered with a cybersecurity firm to manage the incident.

"We know a lot of that information is out there anyway, but people will be worried and all members should be concerned," added Khoury-Haq.

The National Crime Agency (NCA) arrested 4 suspects in connection with the cyberattacks last week — three of them teenagers — at their home addresses in the U.K. They are under investigation and have been accused of multiple offenses, such as money laundering, blackmail, and participating in an organized crime group.

Co-op has not yet disclosed the cost of the attack, as it is still in the process of restoring its systems. The company stated initially, in April, that hackers had caused only a “small impact,” but after the hack became public, it admitted the stolen data belonged to a “significant number” of the retailer’s current and past members.