Co-op Member data breach

In April 2025, the Co-op was targeted in a cyberattack carried out by a criminal group called DragonForce – the same group linked to the cyber attack on M&S and an attempted breach of Harrods. 

The attack forced parts of Co-op’s IT systems offline, causing disruption across its operations. Gaps appeared on shelves in some of its 2,000 grocery stores, and over 800 funeral parlours temporarily reverted to paper-based working after losing access to digital systems.

Co-op initially stated that only a “significant number” of customers were affected. It later emerged that the breach impacted every one of its 6.5 million members. Co-op CEO Shirine Khoury-Haq confirmed the full scale of the breach in July 2025, saying she was “incredibly sorry” for what had happened. ”It hurt my members, they took their data, and it hurt our customers and that I do take personally,” she said.

The attackers were able to copy data from one of Co-op’s systems. The stolen data includes names, contact details – including residential addresses, email addresses and phone numbers – and dates of birth. Co-op has confirmed that passwords, bank or credit card details, transaction histories and information relating to members’ products or services were not accessed.

Despite having early-warning systems that detected suspicious activity within hours, Co-op acknowledged it did not hold cyber insurance and does not expect to recover the majority of the costs resulting from the attack. 

In July 2025, four individuals were arrested in connection with the attacks on Co-op, M&S and Harrods – three of them teenagers – on suspicion of blackmail, money laundering and offences under the Computer Misuse Act. All were bailed pending further inquiries.

What are your rights?

Co-op had a legal obligation to protect your personal data. When a cyberattack results in the theft of personal information belonging to 6.5 million members, affected individuals have the right to seek compensation, including where no financial loss has occurred.

Distress, anxiety and loss of control over your personal data are all recognised as grounds for a claim under UK data protection law. The fact that Co-op itself has said it is not offering compensation does not remove your legal right to pursue a claim independently through the courts.

What data breach compensation could you receive?

There is no fixed amount. Each case is assessed on its own merits. Factors that are likely to be relevant include:

• Type of data exposed. Names, residential addresses, email addresses, phone numbers and dates of birth were all accessed. The combination of home address and date of birth in particular increases the risk of identity fraud, which is relevant to the strength and value of a claim.
• Scale of the breach. With 6.5 million members affected, this is one of the largest confirmed UK consumer data exposures by volume. The scale of a breach is relevant to how seriously it is treated by courts and regulators.
• Distress and anxiety. Knowing that your personal information has been stolen by a criminal group causes real harm. Stress, worry and loss of trust are all recognised as non-material harm that can support a compensation claim.
• Risk of fraud and identity theft. Member databases containing names, addresses and contact details are particularly valuable to fraudsters for phishing, impersonation and identity theft. Even where no fraud has yet occurred, the ongoing risk is relevant to a claim.
• Financial loss. If you have experienced any suspicious activity, fraud or financial loss that can be linked to the breach, this would strengthen a claim further.
• Loss of privacy. Your personal data has value, and organisations are required by law to protect it. A failure to do so is itself a recognised basis for compensation.

Frequently asked questions