Yes. A criminal can use a genuine Co-op membership detail to make a fake call sound real.
Co-op Group is the UK co-operative behind Co-op stores and its paid membership scheme, and stolen names, addresses and contact details give callers true personal facts to quote. Co-op said hackers accessed and extracted data from one system during its sustained April 2025 attack, as described in Co-op cyber-incident update. Co-op CEO Shirine Khoury-Haq later said all 6.5 million members had names, addresses and contact information stolen, according to Grocery Gazette coverage of the BBC interview.
Table of Contents
- What was taken in the Co-op attack?
- Why does a real detail make a fake call convincing?
- How should you handle a suspicious call?
- Who should stay alert after the breach?
What was taken in the Co-op attack?
The stolen member data covered personal details such as names and contact details. The Grocer, reporting a Co-op statement, said it did not include passwords, bank or credit-card details, transactions, or product and service information.
Those affected are current and past Co-op Group members. Co-op first described a significant number as affected, then confirmed the full 6.5-million-member list was copied.
Why does a real detail make a fake call convincing?
A real detail lowers suspicion. A caller who states your correct name and address can sound like Co-op support, a delivery team, or a fraud department.
Criminals deliberately use personal information to make phishing emails, texts and calls more convincing, according to National Cyber Security Centre phishing guidance. The stolen Co-op contact list gives them accurate material for that opening trick.
How should you handle a suspicious call?
Do not trust a call because the caller knows you. City of London Police warn never to assume a call is authentic just because the caller already knows basic details such as name or address, as explained in City of London Police fraud warning.
Action Fraud also warns that even a cold caller who gives your full name must not receive personal or financial information during that call. Use these steps:.
- Hang up without giving details, passwords, codes, or payments.
- Contact Co-op or the claimed organisation yourself using its official website or account statement number.
- Report the scam call to Action Fraud.
Who should stay alert after the breach?
Current and past members should treat unexpected Co-op-related calls, texts, and emails with care. The risk is follow-on fraud using true contact details, not direct withdrawal using stolen bank details.
Watch for pressure to act, requests to confirm a code, or instructions to move money. End the call and check through a separate official channel before responding.
You Might Also Like
- M&S Data Breach: Why a Message Quoting Your Birthday Is Not Proof It Is Genuine
- Co-op Data Breach: Why Former Members Should Read the Notice Too
- Co-op Data Breach: Which Member Details Were Taken and Which Were Excluded?