Co-op confirmed that attackers copied members’ personal data during a cyberattack in April 2025. The company says the stolen information included names, addresses, email addresses, phone numbers and dates of birth—but not member passwords, bank details, credit-card details or transaction data.
The widely reported figure of “up to 20 million people” came from the attackers and has not been confirmed as the number of victims. The immediate practical risk for affected people is targeted phishing, impersonation and other scams based on personal information that criminals may now possess.
As an Amazon Associate I earn from qualifying purchases.
What happened to Co-op?
Co-op says it suffered a multi-stage cyberattack on 25 April 2025. Criminals accessed one of the group’s systems and copied data from it. Co-op restricted access to some systems quickly, which it says helped contain the incident and prevent further data access.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →The attack also caused operational disruption, affecting systems used by parts of the business, including stores and deliveries. That disruption should not be confused with the separate question of what customer data was extracted.
#1 Best Overall
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
The incident formed part of a wider wave of attacks affecting major UK retailers, including Marks & Spencer and Harrods. The attacks, and the information involved, were not necessarily identical. The National Cyber Security Centre’s account describes the event as part of a significant cyber threat to UK organisations.
On 2 May 2025, the Information Commissioner’s Office confirmed that it had received a report from Co-op. Co-op publicly acknowledged that attackers had copied data from one of its systems and that a significant number of current and former members were affected.
The DragonForce cybercrime group claimed responsibility in reporting about the incident. That claim should not be treated as the same thing as an independent or official technical attribution.
What Co-op data was stolen?
Co-op’s later member FAQ gives the clearest official description. It says the extracted information included:
Rank #2
- [Upgraded Version] - This external hard drive features a mirrored logo stripe combined with a striped anti-slip design, and the rounded corners of the casing make it easier to grip. The stripes also have a heat dissipation function, ensuring stable and fast data transfer.
- 【Ultra-thin and quiet】 - The motherboard adopts JMicron 578 noise-free solution, giving you a quiet working environment. Lightweight and portable size designed to fit in your pocket for easy portability.
- 【Ultra-Fast Data Transfers】 - Pairing this external hard drive with JMicron 578 solution USB 3.0 and USB 2.0 interfaces enables blazing-fast data transfer. It boasts theoretical read speeds of up to 125MB/s and write speeds of up to 103MB/s.
- 【Plug and Play】 - With no software to install, just plug it in and the drive is ready to use.The hard disk chip is wrapped with an aluminum anti-interference layer to increase heat dissipation and protect data.
- 【What You Get】 - 1 x Portable Hard Drive, 1 x USB 3.0 Cable, 1 x User Manual, Gift-type shell packaging ,Three-year manufacturer's warranty and free technical support services.
- Names
- Residential addresses
- Email addresses
- Telephone numbers
- Dates of birth
Early reports referred more generally to names and contact details. The later inclusion of dates of birth is important: combined with a name, address and phone number, a date of birth can make an impersonation attempt sound much more convincing.
What Co-op says was not taken
Co-op says the affected data did not include:
- Member passwords
- Bank details
- Credit-card details
- Transaction information
- Information about members’ or customers’ Co-op products and services
Co-op also says member passwords were not stored in the affected system. This is the company’s stated assessment of the incident; it does not amount to a guarantee that no credential anywhere in the wider attack was accessed. However, the available official information does not confirm that Co-op member passwords or payment data were stolen.
How many people were affected?
The confirmed position is that a significant number of current and former Co-op members were affected. There is no official Co-op statement in the material available here that confirms 20 million unique people as victims.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The “up to 20 million” figure came from claims attributed to DragonForce. The attackers reportedly described a database containing records for current and former members. Initial coverage did not independently verify that maximum. TechRadar reported the 20 million claim, while BleepingComputer covered both the attackers’ claims and Co-op’s confirmation of data theft.
Rank #3
- High capacity in a small enclosure – The small, lightweight design offers up to 6TB* capacity, making WD Elements portable hard drives the ideal companion for consumers on the go.
- Plug-and-play expandability
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- SuperSpeed USB 3.2 Gen 1 (5Gbps)
Later reporting cited approximately 6.5 million Co-op members. That figure should be attributed to the reporting rather than presented as a directly confirmed number from Co-op’s FAQ.
These figures are not necessarily contradictory. A database can contain historical, duplicate, inactive or outdated records. The number of records, the number of current members, the number of former members and the number of unique people whose data was actually extracted may all be different.
The safest summary is therefore:
- Confirmed: a significant number of current and former members were affected.
- Reported later: approximately 6.5 million members were cited by secondary reporting.
- Unverified attacker claim: up to 20 million people may have been represented in the database.
Are Co-op passwords or bank accounts at risk?
Co-op says passwords were not stored in the affected system and were not compromised. It also says bank details, credit-card details and transaction data were not extracted.
Free tools Windows power users keep installed
One-click scans. No signup required.
That means this incident does not establish that criminals can log in to a Co-op account or directly use a stolen Co-op payment card. It would nevertheless be unwise to treat an unexpected message as genuine simply because it contains accurate personal details.
Rank #4
- 【Versatile Storage Expansion – For Gaming, Work & Everyday Use】 Running out of space on your PS5 or Xbox Series X/S? This external hard drive lets you store and play PS4 / Xbox One games directly, instantly freeing up your console’s internal storage for next‑gen titles. At the same time, it handles work file backups, media libraries, and cross‑device data transfers with ease. One drive, all your needs. *（Note: PS5 / Xbox Series X|S games cannot be run or stored directly from the external hard drive. However, by offloading your PS4 / Xbox One games, you can free up valuable space for newer titles.）*
- 【Patented Silicone Sleeve – Data Protection You Can Count On】 Worried about drops? We’ve got you covered. The patented built‑in silicone sleeve acts like a shock‑absorbing armor, cushioning your drive against bumps and falls. Whether it’s important work documents, precious family photos, or hard‑earned game saves, your data deserves this level of protection.
- 【Plug & Play, Compatible with Computers & Consoles】 No complicated setup—just plug in and go. Works seamlessly with Windows, Mac, and Linux computers, as well as PS4, PS5, Xbox One, and Xbox Series X/S. Process files at the office, back up data at home, or enjoy gaming in your downtime—one drive handles all your devices, simply and hassle‑free.
- 【USB 3.0 Ultra‑Fast Transfer – No More Waiting】 Tired of watching progress bars crawl? With USB 3.0 speeds up to 5Gbps, large files transfer in seconds. Whether you’re moving work documents, transferring hundreds of gigs of games, or backing up a year’s worth of photos, you get more done in less time.
- 【Sleek, Lightweight, and Ready to Go】 Weighing just 0.16 kg—lighter than a can of soda—this compact drive features a stylish mirror‑and‑frosted finish. Toss it in your bag and go, whether you’re heading to the office, visiting a friend for a gaming session, or giving a presentation on the road.
If you reused a Co-op password on another website, change it on that other service and anywhere else it was reused. Use a different, unique password for every account, and enable multifactor authentication wherever it is available. Those steps are sensible because password reuse creates risk independently of whether the Co-op password itself was taken.
What is the main risk now?
The most credible follow-on risk is social engineering: scams designed to persuade you to reveal information, approve a payment or hand over access to an account.
Possible approaches include:
- A fake Co-op refund, compensation or membership message
- A request to “verify” your account or update personal details
- A phone call claiming to be from Co-op, your bank, a delivery company or a government agency
- A text message containing a link or QR code
- A request for a one-time passcode, card number, password or online-banking details
- A fraudster combining Co-op information with data from another breach
Knowing your name, address or date of birth does not give someone access to your bank account by itself. It can, however, make a fraudulent call or message appear authentic. Correct personal details are not proof that the person contacting you is genuine.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →What should Co-op members do?
- Be suspicious of unexpected contact. Do not assume an email, text or call is genuine because it mentions Co-op or contains information about you.
- Do not disclose security information. Never provide passwords, one-time codes, card details or online-banking information in response to an unsolicited contact.
- Avoid message links. Open the official Co-op website or app independently rather than using a link in an unexpected email or text.
- Change reused passwords. Replace any password reused on other services with a unique one. A password manager such as 1Password or Bitwarden can help, but buying software is not necessary for every reader.
- Turn on multifactor authentication. Prioritise email, banking, shopping and other accounts containing sensitive information.
- Check financial accounts as a precaution. Co-op says payment data was not extracted, but routine monitoring can help identify unrelated fraud quickly.
- Keep evidence. Save screenshots, sender addresses, telephone numbers, message content and payment information if you receive a suspicious approach.
- Report suspected fraud or phishing. Use the relevant official UK reporting route and contact your bank immediately if you have disclosed banking information or authorised a suspicious payment.
Co-op’s own guidance says members do not need to take specific action unless contacted directly, while advising them to remain alert to suspicious communications. There is no need to reset every password solely because of this incident if it was unique and Co-op’s account remains consistent with its published FAQ.
Best Value
- High-capacity external hard drive with up to 2TB of storage The ModusTech Facet portable external hard drive gives you dependable HDD storage in a slim 2.5-inch design. Multiple capacities available up to 2TB — back up photos, videos, music, documents, and game libraries with room to grow. A trusted external storage solution for everyday backup, media archives, and creative work.
- USB-C and USB 3.1 connectivity with included 2-in-1 cable The Facet ships with a USB-C to USB-C cable and tethered USB-A adapter, so this external hard drive connects to modern laptops, USB-C iPhones, tablets, and older USB-A computers without buying an extra cable. USB 3.1 Gen 1 (5Gbps) interface delivers real-world transfer speeds up to 100MB/s — fast enough to back up 50GB of files in about 8 minutes.
- Plug-and-play external hard drive for PC, Mac, and laptops Preformatted in exFAT and ready to use the moment you plug it in. The Facet works out of the box with Windows PCs, macOS Macs, MacBooks, Chromebooks, and laptops — no drivers, no software, no setup required. A true plug-and-play external hard drive built for everyday use across every major operating system.
- External hard drive for PS4, Xbox One, and Smart TV gaming The Facet is compatible with PlayStation 4, Xbox One, and Smart TVs with USB support. PS4 and Xbox One games run directly from the drive — plug it in, format through the console, and add to your storage. Also works with Smart TVs that support USB recording or external media playback.
- Slim, shock-resistant portable external hard drive — 160g At 2.5 inches and just 160g, this portable external hard drive is bus-powered through a single USB-C cable — no separate power adapter, no extra cables. Slim enough for a laptop bag, jacket pocket, or camera bag, with a shockresistant casing and faceted diamond-texture top panel that resists fingerprints and everyday wear. Backed by a 1-year limited warranty from ModusTech, a consumer electronics brand specializing in external storage.
Can members still use their Co-op card and app?
Co-op says membership remains active and members can continue earning and spending rewards. Its FAQ also says members can continue using their membership card and app.
The incident concerned Co-op Group systems. It should not automatically be assumed to affect members of other independent regional co-operative societies. Co-op’s FAQ says data belonging to members of other co-operative societies was not affected by this incident.
What has changed since the first reports?
- Initial reports: It was not yet clear whether customer data had been taken.
- 2 May 2025: Co-op confirmed that attackers had copied data from one of its systems.
- Later official clarification: Co-op specified names, addresses, email addresses, telephone numbers and dates of birth, while excluding passwords, payment details and transactions.
- Current published position: Co-op says it worked with the NCSC and National Crime Agency, strengthened its security and considers member passwords uncompromised because they were not stored in the affected system.
Co-op’s FAQ also says it is not offering compensation. That is the company’s current published position, not a legal determination that no individual claim or future regulatory outcome could ever arise.
What remains unknown?
The available information does not establish:
- The exact number of unique people whose data was extracted
- Whether every record described by the attackers was copied
- How many records were current, historical, duplicate or inactive
- Whether any additional datasets were accessed beyond the categories Co-op has described
- The final outcome of law-enforcement or regulatory work
Deleting a membership account now may be a personal choice, but it cannot guarantee that information already copied by an attacker has been erased. Similarly, identity-monitoring services may help detect some misuse but cannot prevent phishing or remove data that has already been taken. Services such as Cifas Protective Registration may be relevant to people facing heightened impersonation risk, but are not automatically necessary for every Co-op member.
The bottom line
Co-op’s data theft was real, but “up to 20 million affected” was an unverified maximum linked to an attacker claim, not a confirmed victim count. Co-op says the exposed information consisted of personal details—including dates of birth—and that passwords, bank details, card details and transaction data were not extracted. Treat unexpected contact as a potential scam, use official channels independently, change reused passwords and enable multifactor authentication.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
