Co-op CEO acknowledges personal data has been stolen from all 6.5M Co-op Group members

Shirine Khoury-Haq, CEO of the Co-op Group, has confirmed that all of its 6.5 million members had their data stolen in a recent cyberattack.

“I’m devastated that information was taken. I’m also devastated by the impact that it took on our colleagues, as well as they tried to contain all of this,” she said in an interview with the BBC on Wednesday.

Khoury-Haq declares that full names, home addresses, email addresses, phone numbers, and dates of birth were stolen. The attackers didn’t succeed in exfiltrating financial data, purchase history, or other transaction data, she added.

During the interview, the CEO of the Co-op Group said that she was “incredibly sorry” for the incident and that it felt personal to her because of its impact on her colleagues.

“Early on, I met with our IT staff, and they were in the midst of it. I will never forget the looks on their faces, trying to fight off these criminals,” she said.

The data breach has been linked to a ransomware operation called Scattered Spider, which deployed DragonForce ransomware to pull off the cyberattack. Members of the gang claimed to have stolen private information of 20 million Co-op customers. According to Khoury-Haq, personal information of 6.5 million current and former Co-op Group Members has been taken.

Last week, the National Crime Agency (NCA) arrested four people suspected of being involved in the cyberattacks on Co-op, Marks & Spencer, and Harrods: a 17-year-old British man from the West Midlands, a 19-year-old Latvian man from the West Midlands, a 19-year-old British man from London, and a 20-year-old British woman from Staffordshire.

They’re accused of suspicion of blackmail, money laundering, offences under the Computer Misuse Act, and participating in a criminal organization. The suspects were all arrested at their home addresses. Their computers were seized for digital forensic analysis.

“Today’s arrests are a significant step in that investigation, but our work continues, alongside partners in the UK and overseas, to ensure those responsible are identified and brought to justice,” Deputy Director Paul Foster, Head of the NCA’s National Cyber Crime Unit, said in response.