UK retailer Co-op has confirmed that personal data of 6.5 million members was stolen in the massive cyberattack in April that shut down systems and caused food shortages in its grocery stores. BleepingComputer was told that the attack was linked to threat actors associated with Scattered Spider, who were linked to the Marks & Spencer (M&S) cyberattack where the DragonForce ransomware was deployed. The cyberattack occurred in April, forcing Co-op to shut down several IT systems to prevent the threat actors from further spreading to devices and ultimately deploying the DragonForce ransomware encryptor. Sources told BleepingComputer at the time that the breach initially occurred on April 22, after the threat actors conducted a social engineering attack that allowed them to reset an employee's password. Initially downplayed as an attempted intrusion into its network, the company later confirmed that a "significant" amount of data was accessed and stolen during the attack. Co-op's CEO, Shirine Khoury-Haq, apologized today on the BBC Breakfast show, confirming that the attackers successfully stole the data for all of its 6.5 million members. They also shared samples of data with the BBC, claiming that Co-op's corporate and customer data had been stolen during the attack. The BBC reported that they spoke to the DragonForce ransomware operator about Co-op, who confirmed one of its affiliates was behind the attack. The CEO said the breach felt like a personal attack, not on her, but rather on the Co-op's members and employees who were impacted. Threat actors commonly steal this file to extract and crack passwords offline, allowing them to further spread to other devices on the network. Co-op (short for the Co-operative Group) is one of the United Kingdom's largest consumer co-operatives, operating food stores, funeral services, insurance, and legal services. Last week, the UK's National Crime Agency (NCA) arrested four people suspected of being involved in the attacks on Co-op, M&S, and an attempted one on Harrods. It is reported that one of the suspects arrested is linked to a 2023 attack on MGM Resorts that resulted in the encryption of over 100 VMware ESXi virtual machines. Once they gained access to the network, they spread to other devices and ultimately stole the Windows domain's Windows NTDS.dit file. Lawrence Abrams Lawrence Abrams is the owner and Editor in Chief of BleepingComputer.com. Lawrence's area of expertise includes Windows, malware removal, and computer forensics.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Wed, 16 Jul 2025 22:30:15 +0000