Co-op confirmed on 10 August that Debbie White would step down as chair and leave the board, with senior independent director Moni Mannings OBE taking over on an interim basis. White joined the board in 2023 and became chair in 2024.
What changed this week
White’s departure means the Co-op is dealing with another significant leadership transition while it continues the work of stabilisation and transformation that followed last year’s attack. A permanent Group CEO is also being recruited following Shirine Khoury-Haq’s departure earlier in 2026.
The governance story matters because cyber incidents are often reported as technical episodes: breach discovered, systems isolated, attackers removed, services restored. The business reality is much less tidy.
The attack is still part of the story
The April 2025 attack caused major disruption across Co-op’s operations. The group later confirmed that data relating to all 6.5 million members had been stolen. Its 2025 financial results reported a £107 million hit to profitability directly attributable to the cyberattack, alongside a wider annual pre-tax loss of £126 million.
That is why the latest leadership news belongs in the same resilience conversation. Not because a cyberattack should be presented as the sole reason for an executive departure, but because severe incidents can become multi-year business events.
From cyber incident to governance issue
Boards are increasingly being forced to look beyond prevention. Identity controls, endpoint tooling, monitoring and response all matter, but they are still operating inside a connected estate. If an attacker obtains valid access, the blast radius is determined by what that connected identity can reach.
That changes the resilience question. It is no longer simply, “Can we stop the intrusion?” It becomes, “What have we deliberately put beyond the intrusion?”
What changes when critical data is offline
Offline Secure Storage does not replace operational systems. It gives an organisation somewhere deliberately separate to hold information and clean recovery assets that do not need to remain continuously reachable.
For a retailer or membership organisation, that can include historical member records, board and executive material, recovery data, selected master datasets, sensitive legal material and other assets where permanent connectivity creates more risk than value.
The control is physical as well as logical. When the storage path is disconnected, compromised credentials on the connected estate cannot simply traverse the network to reach the asset.
Five questions boards should ask
- Which datasets would create the biggest financial, regulatory or reputational impact if they were exposed?
- Which recovery assets must remain clean if identity and administration systems are compromised?
- What sensitive information is connected today simply because that is how the architecture evolved?
- Which data can be taken out of the standing attack surface without disrupting normal operations?
- Can the organisation prove that its most important recovery copy is physically unreachable when it is not required?
