Co-op Cyber Attack 2025: The Hidden Risk of Third-Party Access in Retail

📜 Introduction to the Co-op Cyber Attack

The Co-op cyber attack in April 2025 exposed how third-party access can quietly open the door to massive disruption in retail. As one of the UK’s largest retailers, Co-op was forced to disconnect parts of its network to stop ransomware spreading, after hackers from DragonForce infiltrated through a trusted external connection. The result was staggering – £206 million in lost revenue, according to Co-op’s official earnings report, and a wake-up call for every organisation relying on third-party systems.

For CISOs and CTOs, this incident is a reminder that convenience in supply chain access can come at a steep price. Even when your own defences are strong, external partners may introduce unseen weaknesses. Our team at CyPro has seen similar issues across industries, from retail to FS, where access management gaps have led to costly breaches. That’s why we help clients strengthen identity controls through our Incident Response & Forensics and Identity & Access Management services – ensuring rapid containment and tighter oversight before damage spreads.

In this article, we’ll unpack what happened during the Co-op cyber attack, how third-party access played a crucial role, and what lessons other retailers can learn to protect their data. We’ll also compare insights from cases like the British Library cyber attack to highlight broader patterns across sectors. By the end, you’ll have clear, actionable takeaways to reduce your organisation’s exposure to similar risks.

🏢 About the Co-op

The Co-op cyber attack highlighted the vulnerability that comes with scale and complexity. The Co-op is one of the UK’s largest retail groups, with thousands of stores, over 60,000 employees and a broad mix of operations spanning food retail, insurance, funeral care and legal services. Its cooperative model centres on community, fairness and customer trust – qualities that make it both respected and a prime target for cyber threats. The organisation’s digital transformation journey has introduced multiple third-party systems for payments, logistics and supply chain management, creating a vast web of access points that can be exploited if not carefully managed.

Complex IT Environment and Third-Party Dependencies

Retail operations at this scale rely on seamless integration between internal systems and external partners. From inventory platforms to payment gateways, these connections enable efficiency but also increase risk. At CyPro, we often see large retail groups facing similar challenges – balancing openness with control. Our Security Assessments & Audits help organisations like this understand where third-party access may create exposure, while our Identity & Access Management solutions tighten authentication and oversight across distributed environments.

🔍 What Happened: Co-op Cyber Attack Incident Overview

The Co-op cyber attack in April 2025 was a coordinated breach led by the DragonForce hacking group that exploited third-party access to infiltrate the retailer’s network. The attack began as a data exfiltration attempt and escalated into a ransomware threat, prompting Co-op to take decisive action to contain the damage. Early detection and swift network disconnection prevented a full ransomware lockdown, but the breach still caused extensive disruption and data loss.

• Date of attack: April 2025
• Threat actor: DragonForce, known for retail-focused extortion campaigns
• Type of breach: Third-party compromise leading to data theft and attempted ransomware deployment
• Data affected: Personal details of 6.5 million Co-op member customers – names, dates of birth and contact information (no financial or password data exposed)
• Operational impact: Temporary loss of trading systems, disrupted stock availability, and reduced daily spend by 11%
• Estimated financial loss: £206 million in revenue, confirmed in Co-op’s official earnings report
• Response: Co-op proactively disconnected key systems, refused ransom demands, and engaged UK authorities including the National Crime Agency

According to reports from specialists, the early containment step was crucial. Co-op’s decision to isolate networks prevented the extensive downtime seen at other retailers like Marks & Spencer, which faced weeks of suspended operations following ransomware encryption. This highlights how rapid incident response and defined playbooks can drastically reduce business impact.

At CyPro, we often support organisations facing similar breaches through our Managed Detection & Response (MDR) service. Continuous monitoring and quick isolation help contain threats before they spread. We also recommend reviewing post-incident procedures with our team to ensure readiness for future events – guidance on this can be found in How to Recover From a Cyber Attack.

⚙️ How It Happened: Root Causes & Attack Mechanism

The Co-op cyber attack was not just a case of bad luck – it was the result of a chain of weaknesses that lined up perfectly for exploitation. The attackers, linked to the DragonForce group with ties to Scattered Spider, took advantage of compromised third-party credentials and weak authentication controls to slip through an external connection into Co-op’s retail IT environment. Once inside, they moved laterally and prepared a double-extortion ransomware payload, forcing Co-op to disconnect its network to stop further spread.

Third-Party Access: The Point of Entry

DragonForce is known for targeting supply chain links, and the Co-op cyber attack followed that pattern exactly. The group exploited a supplier’s remote access account that lacked multi-factor authentication (MFA). Using stolen credentials obtained through phishing, they entered the system undetected, bypassing perimeter controls. This highlights how even a minor lapse in access management can open the door to major disruption. At CyPro, we often see similar gaps during our Security Assessments & Audits – especially where legacy access agreements have been left unchecked for years.

Weaknesses in the Environment

Several underlying issues made the environment more susceptible. Legacy infrastructure, fragmented security governance and limited monitoring combined to reduce visibility over external connections. The absence of continuous identity verification meant that once attackers gained access, they could blend into normal traffic. Co-op’s quick disconnection avoided total ransomware lockdown but the event still exposed structural weaknesses that many retailers share.

Attack Chain and Techniques

The attack chain was relatively straightforward but highly effective. It began with credential theft from a supplier, followed by remote access exploitation. Once inside, the attackers escalated privileges using common system tools, moved laterally across retail systems, and exfiltrated customer data before deploying ransomware. DragonForce’s tactics align with known MITRE ATT&CK techniques such as “Valid Accounts” for initial access and “Data Encrypted for Impact” for extortion. The use of double-extortion – stealing data before encrypting it – shows the group’s evolving sophistication and financial motivation.

Organisational Factors

Beyond the technical flaws, governance played a major role. In large retail operations, responsibility for external system access often sits across multiple departments, creating blurred accountability. Without centralised oversight, it’s easy for old credentials or unverified supplier connections to linger. Our work with clients following breaches shows how consistent policy enforcement and clear ownership can dramatically reduce risk exposure.

💥 Impact & Consequences of the Co-op Cyber Attack

The Co-op cyber attack in 2025 had deep operational, financial and reputational consequences that extended far beyond the initial disruption. While the immediate outage affected trading and logistics, the longer-term effects were felt across customer confidence, partner relationships and compliance costs. For retail leaders, this incident shows how third-party access risks can quietly undermine resilience if not properly managed.

Operational Disruption

• Supply chains were impacted for several weeks, with delayed stock replenishment and intermittent payment processing failures across stores.
• Daily spend dropped by 11%, reflecting reduced consumer activity and temporary network disconnects during containment.
• Internal teams were forced into manual workarounds, increasing operational overheads and slowing store recovery times.

Financial Repercussions

• Direct revenue loss reached £206 million, confirmed in Co-op’s financial statement.
• Remediation costs included forensic analysis, security upgrades and customer comms campaigns totalling an estimated £15–20 million.
• Potential regulatory fines under the UK GDPR may follow, given the exposure of 6.5 million customer records containing personal details.
• Insurance claims and legal expenses are expected to add millions more in indirect costs over the next fiscal period.

Reputational Fallout

• Media coverage portrayed the breach as part of a systemic retail issue, linking it with parallel incidents at Marks & Spencer and Harrods.
• Customer trust eroded sharply, with membership engagement falling in the months following the attack.
• Third-party vendors faced renewed scrutiny, prompting tighter access reviews across the retail sector.

At CyPro, we’ve seen similar ripple effects in other major breaches such as the British Library Cyber Attack 2023. The common thread is clear – organisations often underestimate how deeply a third-party issue can impact their operations and reputation. A proactive approach, rooted in continuous access reviews and regular recovery planning, makes all the difference.

⏳ Timeline of the Co-op Cyber Attack

The Co-op cyber attack unfolded over several months in 2025, revealing how quickly an intrusion can escalate when third-party access isn’t fully controlled. Below is a chronological breakdown of key events that shaped the incident, from initial compromise to arrests. A visual timeline diagram could help illustrate the sequence and highlight gaps between detection and response.

• April 2025: Co-op detected unusual network activity linked to a third-party integration. Systems were proactively disconnected to prevent ransomware deployment. Reports later confirmed the involvement of the DragonForce hacking group.
• 25 April 2025: DragonForce sent their first extortion message via Microsoft Teams and directly called Co-op’s head of security, demanding payment for stolen data.
• May 2025: DragonForce publicly confirmed to the BBC that they had accessed and exfiltrated Co-op data, providing samples as proof.
• June 2025: The UK Cyber Monitoring Centre classified both the Co-op and Marks & Spencer breaches as Category 2 systemic events, estimating joint losses between £270–440 million.
• 10 July 2025: The National Crime Agency arrested four suspects aged 17–20 in London and the West Midlands for offences under the Computer Misuse Act, blackmail and money laundering.

Our team at CyPro often uses detailed timelines like this during Security Assessments & Audits to help organisations pinpoint detection delays and improve response readiness. Understanding how events unfolded in the Co-op case offers clear lessons for refining incident playbooks and access control strategies.

⚠️ Common Mistakes to Avoid

The Co-op cyber attack revealed several recurring mistakes that many retailers still make when managing third-party access and internal controls. These pitfalls often stem from convenience, legacy systems, and unclear responsibility lines. Below are the most common ones we see and how to avoid them.

• 1. Overly Broad Third-Party Access – Retailers often grant suppliers or logistics partners excessive permissions to keep operations smooth. The problem arises when access isn’t reviewed or revoked after projects end. This creates dormant accounts that hackers can exploit. The fix: adopt strict role-based access and continuous privilege reviews through Identity & Access Management.
• 2. Outdated Systems Left Unpatched – Legacy payment or inventory platforms are common entry points. Teams delay updates because patches might disrupt business operations. But downtime from a breach costs far more. Regular patch schedules and test environments can minimise risk while keeping systems current.
• 3. Lack of Real-Time Monitoring – Without proper monitoring, unusual access patterns go unnoticed until data leaks or ransomware hits. Automated detection tools and alerting thresholds help spot issues early. At CyPro, we often integrate these controls during Incident Response & Forensics engagements to support faster containment.
• 4. No Tested Incident Response Plan – Many organisations have a plan on paper but never test it. During the Co-op cyber attack, delays in coordination reportedly worsened early disruption. Tabletop exercises and dry runs ensure everyone knows their role when real breaches occur.

These mistakes aren’t unique to Co-op; we see them across retail, FS and manufacturing. Regular Security Assessments & Audits help uncover weak spots before attackers do. For deeper insight on recovery strategies, see How to Recover From a Cyber Attack or explore the British Library Cyber Attack for parallels in response lessons.

📝 What Organisations Should Do After the Co-op Cyber Attack

The Co-op cyber attack is a reminder that even trusted connections can become dangerous entry points. Retailers and other large organisations should act now to tighten access, visibility and governance before the next breach occurs. Here are practical steps to strengthen resilience and reduce exposure to similar third-party risks.

1. Review and strengthen access controls. Enable multi-factor authentication (MFA) across all remote and admin accounts. Limit third-party credentials to least privilege and monitor usage through identity management tools. Our Identity & Access Management service helps organisations enforce these controls efficiently.
2. Audit legacy and unused systems. Conduct a full inventory of connected applications and decommission those no longer needed. As highlighted by analysts at Breached.company, legacy systems often contain hidden vulnerabilities that attackers exploit.
3. Enhance logging and detection capabilities. Extend log retention and invest in proactive monitoring to spot anomalies early. A well-equipped Security Operations Centre (SOC) can stop attackers before they escalate. To see how this applies in practice, read How to Recover From a Cyber Attack.
4. Define clear governance. Assign ownership for credentials, patching and third-party access. Establish a structured lifecycle for accounts, ensuring prompt removal when contracts end.
5. Test your response readiness. Run tabletop exercises simulating ransomware or supply chain breaches. Regular practice strengthens coordination and confidence when incidents occur.
6. Prioritise backup and recovery plans. Maintain offline backups and rehearse restoration steps. Rapid recovery can be the difference between temporary downtime and lasting damage.
7. Engage external specialists. Schedule periodic audits or penetration tests with independent experts. At CyPro, our Security Assessments & Audits identify weak points and practical improvements aligned with your business strategy.

📊 Broader Lessons & Trends

The Co-op cyber attack was not an isolated event but part of a wider surge targeting UK retailers. In just ten days, three major brands – Co-op, Marks & Spencer and Harrods – were hit by connected ransomware operations, resulting in estimated losses of up to £440 million across the sector. According to Raconteur, cyber attacks against businesses in the UK are up 16%, highlighting how attackers now exploit supply chain access and shared IT environments more aggressively than ever before.

Retail Under Siege: The New Normal

• Attackers increasingly use double-extortion tactics – stealing data before encrypting systems – to pressure victims into paying.
• Supply chain compromise remains the most common entry route, especially through trusted third-party integrations.
• Under-investment in modernisation leaves many retail systems running outdated infrastructure and legacy authentication models.

These factors create a perfect storm where even well-established retailers can become easy targets. At CyPro, we help organisations strengthen resilience through Identity & Access Management and Security Assessments & Audits, ensuring that vendor permissions and access routes are continuously reviewed and aligned with zero trust principles.

Strategic Shifts After the Co-op Cyber Attack

Industry leaders are now recognising that prevention alone isn’t enough. Resilience and recovery planning must sit at the heart of every cyber strategy. Following the arrests of four individuals aged 17–20 in connection with the retail breaches, it’s clear that organised cyber crime is evolving faster than many businesses can adapt. As Why Traditional Attack Surface Assessments Don’t Work in 2025 explains, outdated assessment methods miss the dynamic risks introduced by third-party access. Retailers must embed continuous monitoring, response readiness and executive-level oversight to stay ahead.

🔚 Lessons from the Co-op Cyber Attack 2025

The Co-op cyber attack reminds us that third-party connections are often the weakest link in modern retail. As supply chains become more digital, the line between internal and external access blurs – and that’s where attackers find opportunity. The breach showed how even trusted relationships can introduce exposure if oversight and authentication aren’t consistent across systems.

For retail leaders and IT teams, this incident isn’t just about what went wrong at Co-op – it’s about what can still go right elsewhere. Regular cyber risk assessments and tighter identity controls can help spot vulnerabilities before they’re exploited. Our Incident Response & Forensics service ensures rapid containment when breaches occur, while our Security Assessments & Audits and Identity & Access Management solutions reduce exposure across complex partner networks.

As we’ve seen, the impact of the Co-op cyber attack goes far beyond immediate revenue loss. It’s a wake-up call for every organisation that shares data or systems with external partners. We encourage all retailers to review their own access management practices and response playbooks. If you’re unsure where to start, reach out to us at CyPro – our team can help you build resilience through proactive security audits and expert guidance. Together, we can make third-party trust safer for everyone.