Former Co-op members should read the breach notice because their old membership records were exposed too. The breach is the April 2025 attack that copied Co-op's membership database, and past members fall inside its scope. CEO Shirine Khoury-Haq confirmed on BBC Breakfast on 16 July 2025 that attackers stole data for all 6.5 million members. BleepingComputer reported the confirmation and apology in BleepingComputer's report on the stolen member data.
Table of Contents
- Why past members are included
- What was taken, and what was not
- Why old contact details still expose you
- What former members should do now
Why past members are included
Co-op said its forensic review found accessed data covered a significant number of current and past members. Bloomberg Law reporting on the Co-op statement described that scope in Bloomberg Law's account of the Co-op statement.
That wording matters because membership systems often keep old contact records after accounts lapse. Leaving, letting a card expire, or stopping shopping at Co-op does not remove an old entry from the copied database.
What was taken, and what was not
The stolen member data included names and contact details. Grocery Gazette described those details as home addresses, email addresses and phone numbers in Grocery Gazette's coverage of the apology to members.
The breach did not include passwords, bank or credit card details, transactions, or product information. Co-op gave that limit in a statement covered by Silicon UK in Silicon UK's account of Co-op's admission.
Why old contact details still expose you
A name paired with an old address, email, or phone number still identifies you. Criminals can reuse those pieces to make a call, text, or email look familiar.
Former members face extra risk because they may not watch for Co-op news. An old email you rarely check can receive a convincing lure while you assume the breach concerns someone else.
What former members should do now
Find and read your notice even if your membership lapsed years ago. Check which old address, email, and phone number you gave Co-op, since those are the details now in circulation. Verify any urgent request through a separately found number before you reply.
- Keep the notice where you can find it for future reference
- Watch old inboxes and voicemail for misuse of your name and address
- Treat unexpected breach-related calls or messages as suspect
- Contact Co-op through its official channels if a message asks for action
You Might Also Like
- M&S Data Breach: What the Customer Notice Says About Household Information
- Sparks Pay and M&S Data Breach: Customer Reference Numbers vs. Card Numbers
- M&S Data Breach: Why an Account Password Reset Does Not Mean Passwords Were Stolen