Co-op declares cyber assault harm price it £206m

The Co-op has disclosed for the primary time the size of the monetary harm it suffered attributable to April’s cyber assault.

The retail, insurance coverage, authorized and funeral care Co-op Group estimates whole prices of £206m as a direct consequence of the assault.

In its half-year monetary assertion, it stated: “When Co-op was focused by a complicated cyber assault, we acted shortly and decisively to quickly shut down quite a lot of programs to comprise the menace. This led to operational disruption.”

Debbie White, chair of the Co-op, added: “The primary half of 2025 introduced vital challenges, most notably from a malicious cyber assault. Our steadiness sheet energy and the magnificent response of our 53,000 colleagues enabled us to keep up important companies for our members and their communities. We should now construct our Co-op again higher and stronger to satisfy the challenges and alternatives that lie forward.”

In its outcomes, the Co-op stated its half-year revenues of £5.5bn had been 2.1% decrease than for a similar interval of 2024, however provided the opinion that the determine would have been 1.5% increased had it not been hit by a cyber assault.

As with Jaguar Land Rover, which has seen its manufacturing traces fall silent following a cyber assault on 31 August, the Co-op has been reported by the Monetary Instances to not have had cyber insurance coverage.

The Co-op outcomes assertion reveals a 1.6% drop in income from its grocery outlets, from £5.603m within the first half of 2024 to £5.484m in the identical half-year interval in 2025. Cabinets had been empty for weeks in its 2,300 shops because of the assault, throughout which it switched off back-office and communications programs.

The assault, which passed off on the finish of April, got here onerous on the heels of an identical assault on Marks and Spencer.

The UK’s Cyber Monitoring Centre (CMC) recognized the Scattered Spider hacking group because the supply of each assaults, and estimated the financial harm from the assaults to be between £270m and £400m, calculated from public and business information sources, together with its personal modelling, and one other determine of round £300m said by M&S in Could throughout its annual outcomes name.

Based mostly on statistics drawn from transactional information platform Fable Information, the CMC reported every day spend on the Co-op dropped by 11% throughout the first 30 days of the incident. It additionally stated that as a result of the Co-op is usually the one bricks and mortar grocery chain in additional remoted and distant components of the nation – for instance, within the Highlands and Islands of Scotland – the incident demonstrated the broader social impacts of such cyber assaults.

“The occasion underscores retail sector vulnerabilities tied to just-in-time inventory programs, lack of back-end storage and excessive dependency on IT-driven order flows. When programs fail, it’s difficult to revert to handbook processes,” stated the CMC.

After initially taking part in down the importance of the assault, the Co-op admitted the info of all 6.5 million of its member clients had been stolen.

Co-op Group chief government Shirine Khoury-Haq stated, throughout an look on BBC Breakfast over the summer season: “I’m extremely sorry. It’s terrible to have occurred. That’s why we really feel like we’ve got to do one thing optimistic now.”

On the time, she expressed aid that Scattered Spider had been caught and evicted from the retailer’s programs earlier than the hacking group may deploy ransomware.