Co-op says cyber-attack cost it £206m in lost sales

The Co-op has said the cyber-attack it suffered earlier this year cost it at least £206m in lost revenues.

The retailer’s IT networks were infiltrated by hackers in April, resulted in payment problems, widespread shortages of goods in shops, and the loss of customer data.

Co-op chair Debbie White said the “malicious” attack had caused “significant challenges” in the first half of 2025.

Overall, the retailer reported a £75m underlying pre-tax loss in the six months to 5 July, compared to a £3m profit in the same period a year earlier.

It also said profits were hit by increased staffing costs and regulations, as well as the cyber-attack.

The full cost of the attack could be much higher as the Co-op said it was also expecting there to be some impact to its business in the second half of the year.

Ms White said the group must now rebuild “better and stronger to meet the challenges and opportunities that lie ahead”.

Co-op reported its total group revenue – the amount of money a company makes from all its business activities – was £5.48bn.

That’s a decrease from the £5.6bn it reported as total group revenue for the same period in 2024.

April’s cyber-attack resulted in empty store shelves and issues with digital payments. The disruption was particularly felt in some rural areas where the local Co-op is the only large supermarket.

After initially downplaying the attack, the Co-op later admitted all 6.5 million of its member customers had their data stolen.

The business’s funeral homes also had to resort to paper-based systems.

Co-op chief executive Shirine Khoury-Haq said she was proud of how the business had responded to the attack and that it highlighted many “strengths”.

“It also highlighted areas we need to focus on – particularly in our Food business,” she said.

The attack on the Co-op came amid a challenging period for the group, as it faces rising costs and and pressure on consumer confidence from the rising cost of living.

Last year, the company reported improved profits but warned in April it would face more than £200m in costs and spending pressures in 2025, including £80m from the impact of shoplifting.

Marks & Spencer and Harrods were both hit by cyber-attacks around the same time, but the Co-op was able to resume normal trading at a faster pace as it discovered the attack earlier.

Marks & Spencer, which stopped all online sales for six weeks following its hack, said it faced a £300m financial hit.

Speaking exclusively to the BBC, hackers who claimed to be responsible for the Co-op cyber-attack said they breached the company’s computer systems long before they were discovered.

But the attackers also said that the Co-op disconnected the internet from IT networks in the nick of time to stop the hackers from deploying ransomware and causing even more disruption.

At the end of August, carmaker Jaguar Land Rover (JLR) also suffered a cyber-attack and the company was forced to shut down its IT networks.

Production at its factories in the UK was also shutdown as a result, and will remain suspended until October at the earliest affecting suppliers as well as factory workers.