The Co-op Group has admitted that personal data of a “significant number” of its members was stolen in a recent cyberattack, after hackers contacted BBC News with damning proof of the breach. The attackers, identifying themselves as the ransomware group DragonForce, claim the attack is far more severe than Co-op initially admitted.

Co-op, which had previously said there was “no evidence that customer data was compromised,” now confirms that the cyber criminals accessed internal IT systems and stole names, addresses, emails, and membership card numbers of current and former members.

Hackers Reveal Evidence to the BBC

DragonForce shared screenshots of internal Microsoft Teams messages and video calls, including an extortion message sent to Co-op’s head of cybersecurity on April 25. The group claimed to have exfiltrated internal databases containing sensitive customer and employee data.

“Hello, we exfiltrated the data from your company. We have customer database, and Co-op member card data,” the hackers wrote.

They also sent a sample dataset of 10,000 customers, including names, home addresses, phone numbers, emails, and membership numbers. The BBC verified the authenticity of the files but destroyed the data and has not published it.

Scope of the Breach and Internal Measures

While DragonForce claims to have stolen data from up to 20 million Co-op members, the company has not confirmed that figure. In an updated statement to the stock market and staff, Co-op disclosed that the breach affects “a significant number” of people and that it is now working with the National Cyber Security Centre (NCSC) and the National Crime Agency (NCA).

Security protocols have been stepped up across Co-op’s operations, including ordering employees to keep cameras on during Teams calls, avoid call transcriptions, and verify participants. These changes appear to be a direct response to the hackers’ access to internal communications.

DragonForce and Broader Cyber Threats

DragonForce is a ransomware gang known for combining data theft with extortion. The group operates a ransomware-as-a-service model, allowing affiliates to use its software for attacks. According to cybersecurity analysts, their tactics resemble those used by Scattered Spider or Octo Tempest—English-speaking, loosely organized cybercriminals operating on platforms like Telegram and Discord, often consisting of tech-savvy teenagers.

The hackers told the BBC they are “putting UK retailers on the Blacklist” and referred to themselves using aliases from the TV show The Blacklist—”Raymond Reddington” and “Dembe Zuma.”

Potential Fallout and Public Response

Co-op has over 2,500 supermarkets, 800 funeral homes, and an insurance arm, with around 70,000 employees nationwide. While the company says no banking or transaction data was stolen, the exposed personal details are still considered highly sensitive and valuable for identity theft or phishing scams.

Government minister Pat McFadden emphasized the need for all businesses to treat cybersecurity as “an absolute priority.”

As investigations continue, the incident underscores the evolving sophistication of ransomware threats and the urgent need for tighter corporate cyber defences in the UK retail sector.

‘Wake-up call’

UK government officials have met over the cyber attacks, with national security staff and the chief executive of the National Cyber Security Centre discussing support for retailers.

In a keynote speech next week setting out government action, minister Pat McFadden – who has responsibility for cyber security – will say the attacks need to be a “wake-up call” for every UK business.

“In a world where the cybercriminals targeting us are relentless in their pursuit of profit – with attempts being made every hour of every day – companies must treat cyber security as an absolute priority.

“We’ve watched in real-time the disruption these attacks have caused – including to working families going about their everyday lives.

“It serves as a powerful reminder that just as you would never leave your car or your house unlocked on your way to work. We have to treat our digital shop fronts the same way.”

Related: How ransomware gangs operate in the UK | Preventing corporate cyberattacks in 2025