Co-op’s chief executive, Shirine Khoury-Haq, has confirmed that all 6.5 million of its members’ data was stolen in a cyber-attack on the retailer in April. The company lost names, addresses, and contact information, but not financial or transaction data. Four people arrested a week ago by police investigating the cyber-attacks at M&S and the Co-op have been bailed. Khoury-Haq expressed her deep sadness for the attack and the impact it had on her colleagues.
The National Crime Agency (NCA) arrested four people from their homes on suspicion of blackmail, money laundering, Computer Misuse Act offences, and participating in an organized crime group. The police also seized electronic devices from the properties. Co-op has not set a figure on the cost of the hack but is working to restore back-end systems. One of its responses to the hack is to partner with a cyber-security recruitment company, The Hacking Games, which identifies young talent to channel their skills into legal careers.
Co-op was one of three retailers, along with Marks and Spencer (M&S) and Harrods, who were victims of cyber-attacks in spring this year. Co-op initially announced that it had been hacked, initially claiming it would only have a “small impact” on its call centre and back office. However, days later, BBC News revealed that customer and employee data had been accessed. Co-op admitted the criminals had accessed data relating to a significant number of its current and past members.
M&S also had customer data stolen and is still recovering from massive disruption, which has cost it millions of pounds.
