Co-op boss steps down as cost of last year’s attack nears £3 million

Co-op’s CEO, Shirine Khoury-Haq, has resigned amid escalating costs from last year’s cyberattack on the UK retailer.

Announcing the move on Thursday, the convenience store operator also raised its estimate of the cost of the April 2021 cyberattack.

During the attack, Co-op was forced to shut down its systems to limit the breach's impact, leading to severe disruption and empty shelves across its 2,300 UK stores.

While the attackers were never confirmed, ransomware gang DragonForce claimed responsibility for the breach, with evidence suggesting they provided the ransomware-as-a-service to the attackers.

However, law enforcers at the National Crime Agency (NCA) focused their investigation on Scattered Spider, an English-speaking group that may have used DragonForce tools, or on the possibility that the two groups were linked or overlapping.

Regardless of who was responsible, the retailer says now that the total cost of the attack is higher than expected, estimating a £285 million hit to revenue, up from previous guidance of £206 million.

The group estimated that the attack reduced profits by £107 million, compared with an estimate of £80 million in September, while also disclosing £21 million of “additional, non-recurring costs.”

UK firms face millions of pounds in losses from cyberattacks

Co-op said in a statement that Khoury-Haq would step down on March 29th.

Kate Allum, a member-nominated Director on the Co-op Group Board, will take over as interim CEO while the company searches for a successor.

In a statement issued on Thursday announcing Khoury-Haq’s departure, the Co-op said that since the cyberattack, it had developed a multiyear strategy to recover and then begin an “ambitious phase of growth.”

“This will require long-term leadership exceeding the tenure that Shirine intended at Co-op,” it added

Last year, it was reported that a cybersecurity incident at carmaker Jaguar Land Rover resulted in a total loss of approximately £1.9 billion and affected over 5,000 UK businesses.

A group calling itself “Scattered Lapsus$ Hunters” claimed responsibility for the attack, although JLR never publicly named a specific group.

Unlock more exclusive Cybernews content on YouTube.