--- title: "Co-op: £80m Profit Hit, 6.5 Million Members Exp… | Firevault" description: "A malicious cyber-attack on the Co-op in April 2025 lost £206m in revenue, hit half-year profits by £80m and exposed data on all 6.5 million members. Here is…" lang: en-GB json-ld: | [ { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Firevault has rewritten the rules for data protection & storage via its offline secure storage (OSS) platform, for users to vault everything that matters.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": "GB" } ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "knowsAbout": [ "Offline Secure Storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Firevault has rewritten the rules for data protection & storage via its offline secure storage (OSS) platform, for users to vault everything that matters.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/news/co-op-cyberattack-2025#webpage", "url": "https://fire-vault.com/news/co-op-cyberattack-2025", "name": "Co-op: £80m Profit Hit, 6.5 Million Members Exp…", "description": "A malicious cyber-attack on the Co-op in April 2025 lost £206m in revenue, hit half-year profits by £80m and exposed data on all 6.5 million members. Here is…", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://fire-vault.com/images/og/og-news-article.jpg" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/news/co-op-cyberattack-2025#breadcrumb" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/news/co-op-cyberattack-2025#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Learn", "item": "https://fire-vault.com/learn" }, { "@type": "ListItem", "position": 3, "name": "Knowledge Vault", "item": "https://fire-vault.com/learn/knowledge" }, { "@type": "ListItem", "position": 4, "name": "Co-op: £80m Profit Hit, 6.5 Million Members Exposed", "item": "https://fire-vault.com/news/co-op-cyberattack-2025" } ] }, { "@context": "https://schema.org", "@type": "NewsArticle", "headline": "Co-op: £80m Profit Hit, 6.5 Million Members Exposed", "description": "A malicious cyber-attack on the Co-op in April 2025 lost £206m in revenue, hit half-year profits by £80m and exposed data on all 6.5 million members. Here is what happened, and why offline storage matters.", "url": "https://fire-vault.com/news/co-op-cyberattack-2025", "image": [ { "@type": "ImageObject", "url": "https://fire-vault.com/images/og/og-news-article.jpg", "width": 1200, "height": 1200 }, { "@type": "ImageObject", "url": "https://fire-vault.com/images/og/og-news-article.jpg", "width": 1200, "height": 900 }, { "@type": "ImageObject", "url": "https://fire-vault.com/images/og/og-news-article.jpg", "width": 1200, "height": 675 } ], "thumbnailUrl": "https://fire-vault.com/images/og/og-news-article.jpg", "author": { "@type": "Person", "name": "Mark Fermor", "jobTitle": "Director & Co-Founder", "worksFor": { "@id": "https://fire-vault.com/#organization" }, "url": "https://fire-vault.com/why-oss/about" }, "publisher": { "@type": "NewsMediaOrganization", "name": "Firevault", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 600, "height": 60 } }, "datePublished": "2025-10-15T09:00:00+00:00", "dateModified": "2026-07-04T16:03:24.303926+00:00", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://fire-vault.com/news/co-op-cyberattack-2025" }, "inLanguage": "en-GB", "articleSection": "Offline Security", "wordCount": 680, "keywords": "Co-op:, Offline Security, data breach, cyber security, offline secure storage, data protection, physical air gap", "articleBody": "In April 2025, the Co-operative Group was forced to shut down parts of its IT systems after discovering an attempted hack. The impact rippled through its 2,000-plus grocery stores and 800-plus funeral parlours: gaps appeared on shelves, and funeral colleagues fell back on paper-based systems while digital services were unavailable. In September 2025 the group confirmed the financial damage. Revenu", "dateline": "United Kingdom", "speakable": { "@type": "SpeakableSpecification", "cssSelector": [ "h1", ".article-summary", "h2" ] }, "isAccessibleForFree": true, "copyrightHolder": { "@id": "https://fire-vault.com/#organization" }, "copyrightYear": 2025 } ] --- Recent Breaches Breaches [2026 PowerSchool 62.4M records ](https://www.bleepingcomputer.com)[2026 DISA Global Solutions 3.3M records ](https://techcrunch.com)[2026 Globe Life 850K records ](https://www.securityweek.com)[2026 Lidl GB Customer contact data ](https://www.theguardian.com/business/2026/jun/11/lidl-gb-third-party-data-breach)[2026 Asahi Group Production systems disrupted ](https://www.reuters.com/technology/cybersecurity/asahi-says-cyberattack-disrupted-operations-japan-2025-09-29/)[2026 Kido International 8K records ](https://www.bbc.co.uk/news/articles/c623d7v0e5xo)[2026 Collins Aerospace (RTX) Check-in and boarding disruptio... ](https://www.bbc.co.uk/news/articles/c789e7l1z7po)[2026 Jaguar Land Rover Production and IT systems disru... ](https://www.bbc.co.uk/news/articles/cx2gx8p3rzeo)[2026 Peter Green Chilled Order and logistics data ](https://www.bbc.co.uk/news/articles/c0k7yy8n3g5o)[2026 Adidas UK Customer contact details ](https://www.bbc.co.uk/news/articles/c78jkev1el2o)[2026 PowerSchool 62.4M records ](https://www.bleepingcomputer.com)[2026 DISA Global Solutions 3.3M records ](https://techcrunch.com)[2026 Globe Life 850K records ](https://www.securityweek.com)[2026 Lidl GB Customer contact data ](https://www.theguardian.com/business/2026/jun/11/lidl-gb-third-party-data-breach)[2026 Asahi Group Production systems disrupted ](https://www.reuters.com/technology/cybersecurity/asahi-says-cyberattack-disrupted-operations-japan-2025-09-29/)[2026 Kido International 8K records ](https://www.bbc.co.uk/news/articles/c623d7v0e5xo)[2026 Collins Aerospace (RTX) Check-in and boarding disruptio... ](https://www.bbc.co.uk/news/articles/c789e7l1z7po)[2026 Jaguar Land Rover Production and IT systems disru... ](https://www.bbc.co.uk/news/articles/cx2gx8p3rzeo)[2026 Peter Green Chilled Order and logistics data ](https://www.bbc.co.uk/news/articles/c0k7yy8n3g5o)[2026 Adidas UK Customer contact details ](https://www.bbc.co.uk/news/articles/c78jkev1el2o) [View All →](/learn/breaches) [![Firevault - offline secure storage, physically disconnected from the internet](/assets/logo-color-DBVl0KCg.png)](/) Products Solutions [Why OSS](/why-oss) More [Help](/help)[Get started](/get-started) Overview What HappenedThe Cost, in NumbersThe Common ThreadWhat Offline Storage ChangesLessons for Membership Organisat…ConclusionShareMore Resources [Knowledge Vault](/learn/knowledge)/ Offline Security Offline Security · 15 October 2025 # Co-op: £80m Profit Hit, 6.5 Million Members Exposed A malicious cyber-attack on the Co-op in April 2025 lost £206m in revenue, hit half-year profits by £80m and exposed data on all 6.5 million members. Here is what happened, and why offline storage matters. ![Mark Fermor](/assets/mark-fermor-C-vy1NeN.jpg) Mark Fermor Director & Co-Founder, Firevault 4 min read Share [](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Ffire-vault.com%2Fnews%2Fco-op-cyberattack-2025)[](https://twitter.com/intent/tweet?url=https%3A%2F%2Ffire-vault.com%2Fnews%2Fco-op-cyberattack-2025&text=Co-op%3A%20%C2%A380m%20Profit%20Hit%2C%206.5%20Million%20Members%20Exposed%0A%0AA%20malicious%20cyber-attack%20on%20the%20Co-op%20in%20April%202025%20lost%20%C2%A3206m%20in%20revenue%2C%20hit%20half-year%20profits%20by%20%C2%A380m%20and%20exposed%20data%20on%20all%206.5%20million%20members.%20Here%20is%20what%20happened%2C%20and%20why%20offline%20storage%20matters.)[](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Ffire-vault.com%2Fnews%2Fco-op-cyberattack-2025)[](mailto:?subject=Co-op%3A%20%C2%A380m%20Profit%20Hit%2C%206.5%20Million%20Members%20Exposed&body=A%20malicious%20cyber-attack%20on%20the%20Co-op%20in%20April%202025%20lost%20%C2%A3206m%20in%20revenue%2C%20hit%20half-year%20profits%20by%20%C2%A380m%20and%20exposed%20data%20on%20all%206.5%20million%20members.%20Here%20is%20what%20happened%2C%20and%20why%20offline%20storage%20matters.%0A%0Ahttps%3A%2F%2Ffire-vault.com%2Fnews%2Fco-op-cyberattack-2025) Offline Security #OSSOffline Secure Storage® Article record **Offline Security**Category **15 October 2025**Published **4 min read**Reading time **Mark Fermor**Written by Why it matters ## What this means for organisations holding critical data A malicious cyber-attack on the Co-op in April 2025 lost £206m in revenue, hit half-year profits by £80m and exposed data on all 6.5 million members. Here is what happened, and why offline storage matters. In this analysis 1. 01 [What Happened](#section-0) 2. 02 [The Cost, in Numbers](#section-1) 3. 03 [The Common Thread](#section-2) 4. 04 [What Offline Storage Changes](#section-3) 5. 05 [Lessons for Membership Organisat…](#section-4) 6. 06 [Conclusion](#section-5) **On this page**[What Happened](#section-0)[The Cost, in Numbers](#section-1)[The Common Thread](#section-2)[What Offline Storage Changes](#section-3)[Lessons for Membership Organisat…](#section-4)[Conclusion](#section-5) In April 2025, the Co-operative Group was forced to shut down parts of its IT systems after discovering an attempted hack. The impact rippled through its 2,000-plus grocery stores and 800-plus funeral parlours: gaps appeared on shelves, and funeral colleagues fell back on paper-based systems while digital services were unavailable. In September 2025 the group confirmed the financial damage. Revenue lost to the attack is estimated at £206 million, with an £80 million hit to operating profit in the first half of the financial year. The Co-op now expects a £120 million hit to full-year profits, inclusive of any insurance recovery. ## What Happened Robert Elsey, the Co-op's chief digital and information officer, said attackers gained access through social engineering, impersonating a colleague. He described the attack as sophisticated and persistent, with the attackers repeatedly trying to re-enable accounts that Co-op teams were shutting down within minutes. The group first revealed the scale of the data loss in July: all 6.5 million members had personal information stolen, including names, addresses and contact details. Chief executive Shirine Khoury-Haq told the BBC she was 'incredibly sorry'. No financial information, card details or transaction data were taken. ## The Cost, in Numbers - **£206m** in lost revenue attributed to the attack. - **£80m** hit to first-half operating profit; **£120m** estimated hit for the full year, inclusive of insurance recovery. - **Revenue down 2.1%** to £5.5bn in the six months to 5 July; pre-tax result swung from a £58m profit a year earlier to a £50m loss. - **6.5 million members** had personal data stolen — every member of the mutual. - **Limited insurance cover**: front-end response only, with no expected claim on back-end losses, according to CFO Rachel Izzard. > Source: [Co-op says 'malicious' cyber-attack has hit profits by £80m — The Guardian](https://www.theguardian.com/business/2025/sep/25/co-op-says-malicious-cyber-attack-has-hit-profits-by-80m) ## The Common Thread The Co-op attack came days after the incident at Marks & Spencer, and Harrods was forced to shut down some systems in the same wave. Three national brands, three variations of the same pattern: valid credentials obtained through social engineering, then rapid movement across connected estates that were designed to be reachable at all times by staff and third parties. The Co-op's own account is instructive: detection worked, and colleagues began shutting down malicious accounts within minutes. The attackers were persistent enough that containment still ran for weeks, with material impact on food replenishment and funeral services. ## What Offline Storage Changes The Co-op incident highlights two categories of data that do not need to live on always-on infrastructure: - **Historical member records.** Marketing preferences and lifetime membership history do not need to be one credential away from an attacker. They can sit in offline Storage and be brought online only when specifically required. - **Replenishment and funeral reference data.** Master data that changes rarely but underpins day-to-day operations is a prime candidate for immutable, offline copies. When the connected version is compromised, the offline copy becomes the fastest route back to trading and to serving grieving families. Firevault's approach is not to replace the connected estate. It is to remove the data that does not need to be there from the blast radius entirely. ## Lessons for Membership Organisations - Membership data is not a low-value asset. It is exactly the record set adversaries want, because it enables downstream fraud at scale. - Segregate historical archives from live operational systems. If a breach can touch 6.5 million records in one motion, that architecture needs revisiting. - Do not rely on cyber insurance to fill the gap. As the Co-op has publicly acknowledged, back-end losses often sit outside cover. ## Conclusion The Co-op did many things right in its response: fast detection, rapid account shutdown, honest disclosure and a candid update to members. The lesson is architectural, not operational: connected systems will be breached, and the organisations that suffer least are those that have already moved their most sensitive and their most operationally critical data beyond the reach of the network. See how [offline Storage](/storage) protects large-scale member and operational data, or [Vault](/vault) for board-level records. About the author ![Mark Fermor](/assets/mark-fermor-C-vy1NeN.jpg) ### Mark Fermor [](https://www.linkedin.com/in/mfermor) Director & Co-Founder Co-founder of Firevault, focused on offline secure storage and protecting individuals and businesses from fraud, fines, loss and damage. Speaker, owner and advisor. The Firevault view**Offline Secure Storage® keeps a clean copy beyond the reach of an attacker.**[Why #OSS →](/why-oss) Control systems and access**Cut the physical paths attackers and third parties depend on.**[Explore Control →](/solutions/control) Get started**Get started, or talk to a member of the team.**[Get started →](/get-started) How Firevault would handle this ## Physical disconnection removes the path an attacker needs Offline Secure Storage® holds a clean copy of your data on hardware that is physically disconnected, so an intrusion cannot reach it, encrypt it or delete it. [Get started](/get-started)[Talk to the team](/demo) **Hardware**Your data sits on dedicated encrypted hardware **Disconnect**Offline by default, connected only when you say so **Command**Access windows and retrieval under your control **Location**Held in a secure Firevault Bunker Related Reading ## You may also find these useful [ Firevault Offline Security ### Marks & Spencer: The £300m Cyber Lesson A ransomware attack on M&S paused online orders from late April into July, hit profits by an estimated £300 million and exposed customer data. The root cause is a familiar one: too much critical data left connected. 20 Oct 2025 4 min ](/news/marks-and-spencer-cyberattack-2025)[ Firevault Offline Security ### Jaguar Land Rover: Production Severely Hit by Cyber-Attack A cyber-attack severely disrupted JLR's UK vehicle production, forcing plants at Halewood and Solihull offline just as the new September registration plates came in. Here is why physical disconnection matters for OT. 10 Oct 2025 4 min ](/news/jaguar-land-rover-ransomware-2025)[ ![Iran-linked hackers shut down a UK power plant for four days](https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/iran-uk-power-plant-cyber-attack-2026.jpg) Insight ### Iran-linked hackers shut down a UK power plant for four days A small British generator was taken offline for four days after an Iran-linked cyber attack, reported as the first successful intrusion of its kind against UK power generation. The grid held. The control layer did not. 23 Aug 2026 4 min ](/news/iran-linked-hackers-uk-power-plant-shutdown-2026)[ ![GTA 6 leaks: a nightmare or a blip for the biggest video game of the year?](https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/gta6-leaks-rockstar-2026.jpg) Insight ### GTA 6 leaks: a nightmare or a blip for the biggest video game of the year? Unreleased Grand Theft Auto 6 footage has appeared online ahead of Rockstar's official preview, and Take-Two is now in court seeking the identities behind the accounts sharing it. The game will still sell. The material that leaked can never be unseen. 22 Aug 2026 3 min ](/news/gta-6-leaks-rockstar-development-footage-2026)[ ![Nine PBS: 50 Terabytes of History Trapped by a Cloud Vendor That Closed](https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/nine-pbs-archives-cloud-vendor-shutdown-2026.jpg) Insight ### Nine PBS: 50 Terabytes of History Trapped by a Cloud Vendor That Closed A public broadcaster lost access to fifty terabytes of archival footage, spanning seventy years of regional history, when its cloud storage supplier suddenly went out of business. The files are still trapped in a Denver data centre. 18 Aug 2026 4 min ](/news/nine-pbs-archives-cloud-vendor-shutdown-2026)[ ![When Access Fails: Continuity Needs Offline Secure Storage](https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/when-the-grid-fails-offline-secure-storage-business-continuity-2026.jpg) Industry Insight ### When Access Fails: Continuity Needs Offline Secure Storage Fire and grid failure are only one of six ways organisations lose access to their own records. A practical case for holding critical material offline, whatever the cause. 18 Aug 2026 9 min ](/news/when-the-grid-fails-offline-secure-storage-business-continuity) Share this article Offline Security 15 October 2025 4 min read ## Co-op: £80m Profit Hit, 6.5 Million Members Exposed A malicious cyber-attack on the Co-op in April 2025 lost £206m in revenue, hit half-year profits by £80m and exposed data on all 6.5 million members. Here is what happened, and why offline storage matters. ![Mark Fermor](/assets/mark-fermor-C-vy1NeN.jpg) Published by Mark Fermor , Director & Co-Founder Share [](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Ffire-vault.com%2Fnews%2Fco-op-cyberattack-2025)[](https://twitter.com/intent/tweet?url=https%3A%2F%2Ffire-vault.com%2Fnews%2Fco-op-cyberattack-2025&text=Co-op%3A%20%C2%A380m%20Profit%20Hit%2C%206.5%20Million%20Members%20Exposed%0A%0AA%20malicious%20cyber-attack%20on%20the%20Co-op%20in%20April%202025%20lost%20%C2%A3206m%20in%20revenue%2C%20hit%20half-year%20profits%20by%20%C2%A380m%20and%20exposed%20data%20on%20all%206.5%20million%20members.%20Here%20is%20what%20happened%2C%20and%20why%20offline%20storage%20matters.)[](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Ffire-vault.com%2Fnews%2Fco-op-cyberattack-2025)[](mailto:?subject=Co-op%3A%20%C2%A380m%20Profit%20Hit%2C%206.5%20Million%20Members%20Exposed&body=A%20malicious%20cyber-attack%20on%20the%20Co-op%20in%20April%202025%20lost%20%C2%A3206m%20in%20revenue%2C%20hit%20half-year%20profits%20by%20%C2%A380m%20and%20exposed%20data%20on%20all%206.5%20million%20members.%20Here%20is%20what%20happened%2C%20and%20why%20offline%20storage%20matters.%0A%0Ahttps%3A%2F%2Ffire-vault.com%2Fnews%2Fco-op-cyberattack-2025) [Read full article](https://fire-vault.com/news/co-op-cyberattack-2025) ## Suggested Reading - [What is Offline Secure Storage The foundation of physical disconnection ](/offline-secure-storage/what-is-oss) - [Why Offline Secure Storage The case for physical control ](/why-oss) - [Ransomware Defence Hold gold copies offline ](/oss-for-ransomware-recovery) - [Control Physical path control for IT and OT ](/solutions/control) - [Knowledge Vault All articles, guides and whitepapers ](/learn/knowledge) - [Book a Demo See Firevault in action ](/demo) [Back to Knowledge Vault](/learn/knowledge)