Co-op Cyber Attack: What Members Should Do
Co-op confirmed that the attackers took data on all of its 6.5 million members. The theft covered contact details, not financial data, but that is enough to fuel convincing scams.
By Siddharth ShankarUpdated October 20, 2026In April 2025, attackers breached Co-op, and the company later confirmed that member data had been stolen for all 6.5 million members. Reported data includes names, dates of birth, email addresses, phone numbers and home addresses. Co-op said no financial or transactional data was taken. The main risk is phishing and scam calls using real details, so be careful with unexpected messages and report suspicious ones.
Your email may already be in a known data breach. Find out in about 30 seconds.
Free · About 30 seconds · No sign-up · Email not stored
The Co-op is a UK retailer and member-owned group, so many households are members without thinking about it. In 2025 it was one of several well-known UK retailers hit by cyber attacks.
What happened
According to CyberInsider’s report, the attack took place in April 2025 and Co-op first disclosed it on April 30, 2025. Co-op later confirmed that attackers had taken member data.
Who was affected
The report says all 6.5 million Co-op members were affected. If you have a Co-op membership, assume your data was involved, even if you do not receive a personal email.
What data was taken
- Names
- Dates of birth
- Email addresses
- Phone numbers
- Home addresses
What was not taken
The report says no financial or transactional data was taken. It does not say whether passwords were affected, either way, so do not assume. Co-op said accounts were secure and usable. The chief executive said, “We were able to eject them from our systems, but we could not erase what they did.”
Do not guess. See which breaches include your email and what leaked.
Free · About 30 seconds · No sign-up · Email not stored
The real risk: phishing with real details
A name, a birth date, a phone number and a home address are a complete starting kit for a scammer. A message that quotes your address or your Co-op membership looks genuine. Co-op advised members to be wary of unexpected emails or messages that ask for personal information, create urgency or reference the breach.
What to do now
1Treat unexpected messages with suspicion
Do not click links in emails or texts about the Co-op, your membership or a breach. Go to the website yourself.
2Never give out codes or passwords
Genuine staff will not ask for these.
3Report scams
In the UK, forward suspicious emails to report@phishing.gov.uk and texts to 7726.
4Change your password
Do this if you reuse it anywhere. Use a unique password and two-step verification.
5Check your credit file
Dates of birth and addresses are used to apply for credit. Review your file with the UK credit reference agencies.
Why contact details are not harmless
It is tempting to think a breach without card numbers is minor. In practice, contact details are what scammers use to start a conversation. A caller who knows your name, your address and that you shop at the Co-op sounds like someone you already deal with. They can then steer you towards a payment, a “refund” or a request for a security code. The safest habit is to treat every inbound contact about this incident as unverified, however accurate the details sound.
A short checklist for the household
- Tell family members who share your membership that the details may be known to criminals.
- Agree a rule that no one gives out one-time codes, whoever is asking.
- Save the Co-op’s official contact route from its own website, so you do not rely on a link in a message.
- Check your bank and card statements monthly for unfamiliar activity.
- Report scam messages rather than just deleting them, so others are warned.
If you gave details to a suspicious caller
Contact your bank straight away, using the number on your card, and explain what you shared. Change any password you disclosed, and turn on two-step verification. The sooner you act, the more options you have. See what to do if your identity is stolen for the wider steps.
Compare with similar incidents
Another UK retailer incident is covered in our guide to the M&S cyber attack. For the types of data and what they allow, read what each type of breached data means.
Details can change as investigations continue, so check Co-op’s official pages for updates.
Sources
- CyberInsider: Co-op confirms cyberattack exposed data of all 6.5 million members (April 2025, disclosure April 30, 6.5 million members, data types, no financial data, CEO statement)
Frequently asked questions
How many Co-op members were affected?
The report says all 6.5 million Co-op members were affected.
What data did the Co-op attackers steal?
Names, dates of birth, email addresses, phone numbers and home addresses.
Was financial data stolen?
The report says no financial or transactional data was taken.
Were passwords stolen?
The report does not say either way. Use a unique password and two-step verification to be safe.
What is the biggest risk now?
Phishing emails, texts and calls that use real personal details. Do not click links or share codes.
See if your email has already leaked
- Checks your email against known data breaches
- Shows which sites leaked it, when, and what leaked
- We do not store the email you check
Change reused and leaked passwords
NordPass flags weak and reused passwords, and its Premium plan alerts you if your details appear in new breaches.
See NordPass →Affiliate link. We may earn a commission at no extra cost to you.
Prefer a one-time report first? Scan My Shadow, our sister service, $9.99.