Treat a message offering payment for the Co-op data breach, the April 2025 attack on Co-op systems, as suspect if it asks for ID. Verify it by typing the known Co-op website address yourself and comparing the message with Co-op's published member guidance. TechCrunch reported that Co-op Group CEO Shirine Khoury-Haq confirmed attackers stole personal data for all 6.5 million members in that attack TechCrunch report on the Co-op confirmation. Co-op states in its member guidance that it is not offering breach compensation because the risk of harm is very low Co-op's Cyber Incident Member FAQs.
Table of Contents
- What Co-op actually gave members
- Why an ID request points to a scam
- How to check the offer without clicking
- What to do after a suspicious message
What Co-op actually gave members
Co-op says the stolen member data was limited to names, addresses and contact information. It says the theft did not include passwords, bank or credit card details, transactions, or product holdings.
The thank-you gesture was not a cash payment and did not require ID documents. Retail Gazette described it as a time-limited 25% discount saving £10 on a £40 in-store shop for members from 18 June 2025, redeemable once Retail Gazette account of the thank-you offer.
Why an ID request points to a scam
A request for a passport, driving licence, or bank statement does not fit Co-op's stated position. Co-op says it is giving members value such as a £10 off £40 offer rather than paying breach compensation.
The Information Commissioner's Office says it cannot award compensation even if data-protection law was broken. An unsolicited message promising quick compensation therefore conflicts with that process, which requires a claim to the organisation or a court.
How to check the offer without clicking
The National Cyber Security Centre warns that scams often impersonate authority figures and create urgency with short deadlines or threats NCSC guidance on spotting scams. Treat pressure to act today, threats of losing compensation, and links or attachments as reasons to stop. NCSC guidance in its August 2026 document says to break contact after a suspicious ID request and reach the organisation directly through its known official website or app.
- Stop and do not reply, click, or open attachments.
- Open the known Co-op website or app yourself, without using the message link.
- Compare the message with Co-op's published member FAQs and dates.
- Ask whether payment, ID, or a fee was requested, because the real gesture needed no ID.
What to do after a suspicious message
Forward a suspect email to [email protected] and forward a suspect text free to 7726. The National Cyber Security Centre says providers and investigators can then investigate and block senders.
Anyone who lost money or was hacked after responding should report promptly. The National Cyber Security Centre directs people in England, Wales or Northern Ireland to reportfraud.police.uk or 0300 123 2040, and people in Scotland to Police Scotland on 101.
You Might Also Like
- Co-op Data Breach: Why Former Members Should Read the Notice Too
- Co-op Data Breach: Which Member Details Were Taken and Which Were Excluded?
- Co-op Data Breach: Can a Genuine Membership Detail Be Used in a Fake Call?