Attackers copied names, residential addresses, email addresses, phone numbers and dates of birth for all 6.5 million current and past Co-op Group members. Passwords, bank or credit-card details, customer transactions and product or service information were not believed to have been extracted. Co-op Group is the UK retail group behind the Co-op membership scheme. CEO Shirine Khoury-Haq confirmed the full membership scope on BBC Breakfast and said she was incredibly sorry, as reported by TechCrunch's breach coverage.
Table of Contents
- Who was included in the theft?
- Which contact details were taken?
- Which sensitive details stayed out?
- Why does Co-op's wording matter?
- What should members watch for now?
Who was included in the theft?
Both current and past Co-op Group members were included. The member data covered names and contact details, according to Co-op's forensic-update statement reported via Bloomberg Law.
The total was 6.5 million people. That figure covers the complete membership base, not a sample or active-only subset.
Which contact details were taken?
The extracted contact data was residential address, email address and phone number, plus date of birth. Infosecurity Magazine's reporting on Co-op's FAQ listed those five fields together.
Together those fields support identity matching and direct contact. They allow a message to address a person by name, birth date and home address.
Which sensitive details stayed out?
Co-op said members' passwords were not believed to have been extracted, as reported by Silicon UK's coverage of the Co-op statement. That distinction matters for account-takeover risk.
Bank or credit-card details, customer transactions, and information about members' or customers' Co-op products or services were also not believed extracted, as reported by SecurityAffairs' account of the Co-op statement. Payment and purchase history therefore fall outside the stated extraction scope.
Why does Co-op's wording matter?
Co-op described the scope in terms of what investigators believe was extracted and what they do not believe was extracted. It had first reported no evidence of
Data Breach: Why Downtime Alone Does Not Establish Data Theft”>data theft
What should members watch for now?
The practical risk is fraud and impersonation using names, addresses, emails, phones and birth dates. Affected members should treat unexpected Co-op messages as suspicious.
- Pause on urgent refund, password-reset or loyalty-point messages
- Contact Co-op through a known app, card or website address
- Follow NCSC scam-protection advice reported by Grocery Gazette
- Do not reuse emailed links or quoted account details
You Might Also Like
- M&S Data Breach: Why an Account Password Reset Does Not Mean Passwords Were Stolen
- Co-op Data Breach: Why Former Members Should Read the Notice Too
- Sparks Pay and M&S Data Breach: Customer Reference Numbers vs. Card Numbers