2025-04-30 (disclosed) · GB · Co-op Group

Co-op and Harrods cyber attacks, 2025

Disclosed by the affected organisation.

Days after the attack on M&S, the Co-op shut down parts of its IT systems and Harrods said it had seen attempts to gain unauthorised access to its systems. Co-op's chief executive said the attackers accessed member data, and Co-op later estimated a first-half hit of £206 million in revenue and £80 million in costs and lost profit. Co-op has not published how the attackers got in; Help Net Security reported they apparently social-engineered an employee and took over the account by resetting its password. The NCA arrested four people in July 2025 over the M&S, Co-op and Harrods attacks.

£80M (impact, about $108M; Co-op's first-half 2025 estimate: £20 million of one-off costs plus a £60 million profit impact from £206 million of lost revenue. US dollar figure converted at about US$1.35 per pound, the approximate rate in September 2025.)

Timeline

1. 2025-04-30 Co-op says it has proactively shut down parts of its IT systems.
2. 2025-05-01 Harrods says it has experienced attempts to gain unauthorised access to some systems and restricts internet access at its sites.
3. 2025-07-10 The NCA arrests four people on suspicion of offences linked to the M&S, Co-op and Harrods attacks.
4. 2025-09-25 Co-op's interim results estimate the first-half impact at £206 million of revenue, £20 million of one-off costs and £60 million of lost profit.

Lessons

• Review how your IT help desk authenticates staff before password and MFA resets, as the NCSC urged after these attacks.
• Rehearse shutting down systems quickly, and plan how stores, payments and supply chains run on manual processes.
• Tell customers early and plainly what data was taken, since it may be used to target them.

Scam types: Help desk password and MFA reset impersonation, Data theft extortion

Sources

1. Co-op Group: Interim results for six months ended 5 July 2025 (Company disclosure, primary, accessed 2026-09-24)
2. NCA: Retail cyber attacks: NCA arrest four for attacks on M&S, Co-op and Harrods (Law enforcement, primary, accessed 2026-09-24)
3. NCSC: Incidents impacting retailers, recommendations from the NCSC (Regulator, primary, accessed 2026-09-24)
4. The Record: Harrods becomes latest retailer to announce attempted cyberattack (News report, secondary, accessed 2026-09-24)
5. Help Net Security: UK retailers under cyber attack: Co-op member data compromised (News report, secondary, accessed 2026-09-24)