No. Having a Co-op shopping receipt alone does not mean your data was affected. The confirmed affected group is all 6.5 million Co-op Group members, meaning people on the Co-op membership list, including current and past members. Co-op CEO Shirine Khoury-Haq confirmed that member-data theft on BBC Breakfast on 16 July 2025, according to Grocery Gazette's report.
Table of Contents
- Who was confirmed as affected?
- What data was taken?
- Why doesn't a receipt count as proof?
- What should members do now?
Who was confirmed as affected?
The breach affects Co-op Group members, not every person who bought something at a Co-op till. Membership is the paid or registered scheme that links a shopper to Co-op through a member account and card or app.
That distinction matters because casual customers leave little identifying data behind. Reporting on the Co-op statement in May 2025 made the same point, separating members on the membership list from everyday till customers, as described in Infosecurity Magazine's coverage.
What data was taken?
Co-op says attackers extracted members' names, contact details including home address, email address and phone number, plus dates of birth. Those details come from membership records, not from a paper or emailed till receipt. The company detected a criminal cyber-attack in late April 2025 and shut down parts of its IT systems to block ransomware encryption and spread, according to Co-op's Cyber Incident FAQs.
Why doesn't a receipt count as proof?
A receipt shows a transaction happened. Co-op says it does not believe passwords, bank or credit-card details, transactions, or product and service information were extracted, so purchase history alone was not taken.
That is why a receipt cannot place someone inside the affected population. The test is membership: were you a current or past Co-op Group member whose personal details were stored in that system? Co-op phrases both lists as what it believes was or was not extracted. That wording reflects investigation findings, not a guaranteed complete inventory.
What should members do now?
Members should treat unexpected calls, texts, emails, and letters as suspicious. Stolen names, addresses, emails, phone numbers, and birth dates can fuel impersonation, phishing, and fraud, even without payment data. Get Safe Online advises all affected members to take precautions and follow phishing and password guidance after the confirmed theft, as explained in Get Safe Online's alert.
- Do not click links or share codes from unsolicited messages claiming to be Co-op.
- Contact Co-op through a known number or website if a message asks for action.
- Use a strong, unique password and turn on two-step verification for email.
- Watch bank statements and credit reports for unfamiliar activity.
You Might Also Like
- Co-op Data Breach: Why Former Members Should Read the Notice Too
- Co-op Data Breach: Which Member Details Were Taken and Which Were Excluded?
- Co-op Data Breach: How to Verify an Offer of Compensation Before Sharing ID