Co-operative Group set to take £120m full-year earnings hit from cyberattack

The Co-operative has revealed it is set to take a full-year earnings hit of around £120 million from a “malicious” cyberattack that left it with bare shelves and saw data stolen for all its 6.5 million members.

The retailer said the attack in April impacted sales by about £206 million, which caused an £80 million blow to its half-year earnings.

A further £40 million hit is also expected over the second half as it continues to get back on track from the incident.

It said the fallout from the hack left it slumping to a £75 million underlying pre-tax loss for the six months to July 5, down from profits of £3 million a year ago.

It swung to a £32 million underlying operating loss, from earnings of £47 million a year earlier, with the cost of the hack adding to other pressures such as a soaring wage bill after the hike in national insurance contributions in April.

Debbie White, chairwoman of the Co-op, said: “The first half of 2025 brought significant challenges, most notably from a malicious cyberattack.

“Our balance sheet strength and the magnificent response of our 53,000 colleagues enabled us to maintain vital services for our members and their communities.”

Shoppers faced empty shelves and issues with payments after the incident in April.

It came at a time when high street rival Marks & Spencer was also badly impacted by a hack, halting online orders for six weeks from Easter weekend and suffering a profit hit of up to £300 million.

The Co-op said the hacking attempt against the group was “sophisticated” but that it acted “quickly and decisively to temporarily shut down a number of systems to contain the threat”.

The group shut off parts of its IT systems after the attack, in which hackers accessed and extracted members’ personal data.

It confirmed in July that all 6.5 million members of the Co-op had their data stolen.

The group said the hackers impersonated workers to trick employees into giving them access to their accounts.

They created a copy of one of the firm’s files, but were unable to attack its platforms further and install ransomware.

Efforts after the incident included moves to keep essential services such as its funerals business running, while prioritising stock to rural “lifeline” stores.

It said it supported thousands of independent co-op societies and franchise partners to minimise disruption to them, and offered members a £10 discount off a £40 shop as a thank you for their support throughout the disruption.

But the firm said it was still facing the after-effects of the attack, with the group yet to see a full recovery in customer numbers in convenience stores and as it still works to get all back office operations fully up to speed.

Chief executive Shirine Khoury-Haq said: “The cyberattack highlighted many of our strengths.

“But more importantly, it also highlighted areas we need to focus on – particularly in our food business.”

The firm put expansion on hold due to the cyberattack, but now plans to resume with 30 openings expected over its second half, including more food stores.

It has also overhauled some of its leadership and formed a new commercial and logistics division.

Ms Khoury-Haq told the PA news agency: “The cyber incident has offered us a moment to reflect.

“Whenever a business experiences a significant event like this, the real shame would not be to come out stronger.”

With Jaguar Land Rover also suffering widespread and costly disruption from an ongoing hack, she called on the Government to help by making it mandatory to report cyberattacks and ransom demands.

She told PA: “The UK is targeted because it has a tendency to pay more ransoms.

“We don’t have mandatory reporting on payment of ransoms – companies can keep it quiet.”