Co-op Cyber Attack Exposes Millions of Customers in Major Data Breach

DragonForce ransomware group claims responsibility; BBC receives proof of breach affecting 20 million customers.

In a startling revelation, Co-op has confirmed a significant cyber attack that compromised sensitive data of its members and employees—just days after the notorious hacking group DragonForce contacted the BBC with proof of their access. This marks a major escalation from the company's earlier reassurances that the incident had only a “small impact” and posed no threat to customer information.

What Happened?

Hackers claiming to represent DragonForce approached BBC News, presenting evidence of their infiltration into Co-op’s internal systems. The data shown includes usernames and passwords of employees and a sample of 10,000 customer records—featuring names, addresses, emails, phone numbers, and Co-op membership card numbers.

Initially, Co-op stated that there was "no evidence customer data was compromised" and highlighted “proactive measures” taken to fend off the attack. But following the BBC’s inquiry, the company admitted that a "significant number of current and past members" were affected and confirmed a large-scale data breach.

Extent of the Breach

While Co-op declined to confirm the hackers' claim of accessing information for 20 million members, the BBC verified the authenticity of the sample data. The exposed information does not include passwords, financial details, or transaction records, according to a Co-op spokesperson.

The attackers claim to have stolen:

• Co-op membership card data

• Personal details of employees and customers

• Internal communications and credentials

Co-op's internal investigations, in collaboration with the National Cyber Security Centre (NCSC) and National Crime Agency (NCA), are ongoing.

Hackers Infiltrated Teams Chats and Calls

The breach appears more invasive than initially assumed. Screenshots shared by the hackers show direct communication with Co-op's Head of Cybersecurity via Microsoft Teams, dating back to April 25. Hackers also reportedly joined internal meetings and messaged senior executives to pressure them into paying a ransom.

As a result, Co-op has mandated that all employees keep their cameras on during Teams meetings, avoid recording or transcribing calls, and verify participants’ identities.

Who Is DragonForce?

DragonForce is a well-known ransomware group that encrypts victims' data and demands ransom payments. They often leak or sell stolen information as part of their extortion strategy. The group operates an affiliate model, allowing other cybercriminals to use their software tools to conduct attacks.

Interestingly, two hackers from the group identified themselves as “Raymond Reddington” and “Dembe Zuma”—characters from the American TV show Blacklist, which focuses on a wanted criminal assisting the FBI.

The group says they’re “putting UK retailers on the Blacklist,” suggesting more attacks could be underway. DragonForce has also claimed responsibility for a cyber attack on Marks & Spencer (M&S) and an attempted breach at Harrods, though details remain unconfirmed.

Government Response

The UK government has responded swiftly to the breach, with high-level meetings involving national security officials and the NCSC.

Pat McFadden, Minister for the Cabinet Office and responsible for cyber security, emphasized the seriousness of the situation:

“In a world where cybercriminals are relentless in their pursuit of profit, companies must treat cybersecurity as an absolute priority. These attacks are a wake-up call.”

He warned that businesses must protect their “digital shopfronts” just as they would secure physical premises, noting the widespread disruption caused to businesses and the public.

McFadden is expected to unveil a broader government strategy to bolster cyber defense across sectors in an upcoming keynote.

A Warning to All UK Businesses

The Co-op breach exposes glaring vulnerabilities in enterprise-level cybersecurity, even within companies managing sensitive customer data at scale. With over 2,500 supermarkets, 800 funeral homes, and 70,000 employees, Co-op’s operational footprint is extensive—making the breach especially alarming.

Industry analysts say the tactics seen in this attack are reminiscent of those used by Scattered Spider or Octo Tempest, loose groups of English-speaking, often teenage, hackers operating on Discord and Telegram.

What Co-op Members Should Do

Although Co-op insists no financial data was compromised, customers are advised to:

• Monitor accounts for suspicious activity

• Be cautious of phishing emails or messages

• Avoid clicking on unsolicited links

• Report suspicious emails to report@phishing.gov.uk

The Co-op cyber attack underscores the growing threat of organized cybercrime and the urgent need for robust cybersecurity infrastructure in both the public and private sectors. As DragonForce and similar groups intensify their assaults, companies must not only invest in prevention but also prepare for swift response and transparent communication in the event of a breach.