The chief executive of the Co-op has apologised after admitting that all 6.5 million members had their data stolen in a recent cyber-attack. Shirine Khoury-Haq told the BBC she was “incredibly sorry” that hackers obtained names, addresses and contact information.
She stressed that no financial information such as credit or debit card numbers, or transaction data, was compromised in the hack, which occurred in April. “We know a lot of that information is out there anyway, but people will be worried and all members should be concerned,” she said.
Previously, the mutual had only said a “significant number” of customers’ data was accessed. The attack forced the group, which owns over 2,000 grocery stores and 800 funeral parlours, to shut down parts of its IT systems in late April. This led to gaps on shelves and a return to paper-based systems in funeral services.
Co-op executives told MPs that many systems were protected, but the company admitted it was not expecting significant recovery of costs from insurers as it chose to invest in detection systems over cyber-insurance. Last week, four people including three teenagers were arrested in connection with the attacks on Co-op, M&S and Harrods.
The National Crime Agency is investigating the involvement of Scattered Spider, a group of native English-speaking hackers. The Information Commissioner’s Office has advised concerned individuals to visit its website for support.
