Co-op's April 2025 cyber-attack cost £206M in lost sales and exposed all 6.5M members

The Co-op said its April 2025 cyber-attack cost it at least £206 million in lost revenues. Hackers infiltrated its IT networks, causing payment problems, widespread shortages of goods in shops and the loss of customer data, the BBC reported on 25 September 2025. The disruption was felt most in rural areas where a local Co-op is the only large supermarket, and funeral homes had to use paper-based systems.

The retailer reported a £75 million underlying pre-tax loss for the six months to 5 July 2025, against a £3 million profit a year earlier, and group revenue of £5.48 billion, down from £5.6 billion. It said profits were also hit by higher staffing costs and regulation, and expected further impact in the second half, so the full cost of the attack could be much higher.

After initially downplaying the attack, the Co-op later admitted that all 6.5 million of its members had their data stolen. Hackers who claimed responsibility told the BBC they had been inside long before they were discovered, but that the Co-op disconnected its networks from the internet in time to stop them deploying ransomware. The Co-op resumed normal trading faster than Marks & Spencer, which stopped online sales for six weeks and put its financial hit at £300 million.

At least £206M in lost revenue; £75M underlying pre-tax loss for the half year against a £3M profit a year earlier.

Hackers had been inside the Co-op's networks for a long time before the Co-op discovered them, according to the hackers' own account to the BBC.

The Co-op initially downplayed the attack, then admitted the data of all 6.5 million members had been stolen.

The Co-op took its networks offline to stop ransomware, which also halted payments and stock systems and left shelves empty.

The attack landed in a year of rising costs, with the Co-op already warning of more than £200M in cost and spending pressures, including £80M from shoplifting.

Do not minimise a breach before you know its scope. Customers hear 'some data' and later learn it was all of it, which costs trust as well as sales.

Chair Debbie White said the group must now rebuild 'better and stronger'. CEO Shirine Khoury-Haq said the attack highlighted areas to focus on, particularly in the Food business. The BBC noted that M&S, Harrods and later Jaguar Land Rover were hit by cyber-attacks in the same period.