The Co-op has revealed that a cyber-attack on its systems earlier this year wiped out at least £206m in sales, pushing the group into a heavy first-half loss.
The breach, which struck in April, disrupted payment systems, caused stock shortages across thousands of stores, and led to the theft of customer data. In some rural areas, where Co-op shops were the only large supermarkets, the impact was particularly severe.
Chair Debbie White described the attack as “malicious” and said it had caused “significant challenges” in 2025 so far.
Losses Deepen Amid Rising Costs
For the six months to 5 July, the Co-op reported an underlying pre-tax loss of £75m, compared with a £3m profit a year earlier. The group said rising staffing costs, new regulations, and the fallout from the cyber-attack had all weighed on performance.
Group revenue fell to £5.48bn, down from £5.6bn in the same period in 2024. The Co-op warned that the financial impact of the hack would continue into the second half of the year.
Customer Data and Business Operations Hit
Initially, the retailer sought to downplay the scale of the breach. But it later confirmed that the personal details of all 6.5 million of its member customers had been stolen. Its funeral care business was also forced to revert to paper-based systems during the height of the crisis.
Chief executive Shirine Khoury-Haq said the response had demonstrated resilience but also exposed weaknesses.
“It highlighted many of our strengths, but also areas we need to focus on – particularly in our Food business,” she said.
Sector-Wide Cyber Threats
The incident took place during a wave of cyber-attacks against major UK retailers. Marks & Spencer and Harrods were also targeted, with M&S forced to suspend online sales for six weeks, leading to losses of around £300m.
Hackers claiming responsibility for the Co-op breach told the BBC that they had infiltrated its systems long before detection. They added that the retailer’s decision to disconnect its IT networks from the internet at the last minute prevented them from deploying ransomware that could have caused even greater damage.
Wider Industry Impact
The Co-op’s troubles come at a time of mounting cost pressures, from shoplifting losses to rising inflation. The group has warned that its operating costs this year could exceed £200m.
The timing of the attack also coincided with growing vulnerabilities in UK manufacturing. Jaguar Land Rover was hit by a separate cyber-attack in late August, forcing the carmaker to suspend production at its UK sites until at least October.
Despite the challenges, White said the Co-op was committed to rebuilding “better and stronger to meet the challenges and opportunities that lie ahead.”
