The Co-op has become the latest high-profile victim of an attempted cyber attack, according to a letter sent to staff.
The Manchester-based retail and financial giant has been forced to shut down parts of its IT system after discovering an attempted hack only days after fellow retailer Marks & Spencer faced a serious cyber incident.
In a letter to staff sent on Tuesday and seen by the Guardian, the mutual said it had “taken steps to keep systems safe” so had “pre-emptively withdrawn access to some systems for the moment.”
The group owns more than 2,000 grocery stores and more than 800 funeral parlours as well as legal and financial services businesses.
It said the measures to protect its systems included the shutdown of some business services for teams running stores and its legal services division.
The Co-op said all its stores, including rapid home deliveries, were trading as usual, as were its funeral homes.
A Co-op spokesperson said in a statement: “We have recently experienced attempts to gain unauthorised access to some of our systems.
“As a result, we have taken proactive steps to keep our systems safe, which has resulted in a small impact to some of our back office and call centre services.
“We are working hard to reduce any disruption to our services and would like to thank our colleagues, members, partners and suppliers for their understanding during this period.”
The Co-op added that it was “not asking our members or customers to do anything differently at this point”, adding “we will continue to provide updates as necessary.”
The latest attack on a high street giant comes just days after Marks & Spencer was hit, leading to it pausing orders from its websites and apps in response to a “cyber incident.”
The Co-op did not say whether it had detected the attempts to attack its systems as a result of extra checks as a result of the M&S incident, but did tell staff that “protecting our systems is of paramount importance,” referring directly to the M&S incident.
Scott Dawson, CEO of payments processor DECTA, told Prolific North: “The attempted hack on Co-op’s IT systems forced a shutdown of crucial back-office functions and exposed alarming vulnerabilities. Retailers can no longer afford to treat resilience as optional as this becomes more of a trend.
“This incident, coming on the heels of major breaches at Marks & Spencer and other high-profile targets, highlights how brittle legacy architectures and siloed security practices are, and no match for sophisticated threat actors. Until businesses adopt uniform metrics and invest in fail-safe recovery plans, every transaction—and every customer relationship—remains at risk. When a single intrusion forces entire back-office operations offline, every step from inventory management to customer service teeters on collapse.
“Much like the repeated failures of banking apps, this illustrates a fundamental weakness in the resilience of the systems we rely on most. It’s no longer enough to simply talk about resilience; it’s a crucial element of modern business, especially when dealing with finances. The lack of standardised ways to measure resilience has contributed to it being dismissed as mere rhetoric by some business leaders.
“It’s time to move beyond rhetoric: businesses must move from reactive patchwork to proactive resilience engineering architected into every layer of IT strategy, or retailers will continue to pay the price. Only then can retailers protect revenue streams, reputations and the trust of the millions who rely on them.”
