Co-op crisis deepens as it admits UK customer data stolen in cyberattack - up to 20 million people possibly affected, here's what we know

The effects of the recent cyberattack against Co-op could be much more damaging than previously thought after the apparent hackers boasted of stealing huge amounts of company data, including customer information.

The "DragonForce" hackers contacted the BBC, sharing screenshots of their communication with the company, where they claim to have stolen "customer database, and Co-op member card data".

Co-op later appeared to confirm the theft, saying in a statement to BleepingComputer, ""As a result of ongoing forensic investigations, we now know that the hackers were able to access and extract data from one of our systems."

Co-op customer data stolen

"The accessed data included information relating to a significant number of our current and past members," Co-op's statement continued.

"This data includes Co-op Group members' personal data such as names and contact details, and did not include members' passwords, bank or credit card details, transactions or information relating to any members' or customers' products or services with the Co-op Group."

In an attempt to prove itself, the BBC says DragonForce shared databases including usernames and passwords of all Co-op employees, as well as a sample of 10,000 customers data including Co-op membership card numbers, names, home addresses, emails and phone numbers.

The hackers say as many as 20 million people have registered, or have registered in the past, with the Co-op's rewards program, meaning the range of affected users could be huge.

DragonForce said they contacted Co-op's head of cybersecurity and other executives via Microsoft Teams, sharing screenshots of the extortion messages with the BBC.

Co-op had told employees to keep their cameras on while using Microsoft Teams for meetings, as well as being told not to record or transcribe calls, and to verify that all participants were genuine Co-op staff - which suggested the hackers were indeed able to access internal systems.

Co-op has more than 2,500 supermarkets as well as 800 funeral homes and an insurance business, and employs around 70,000 staff across the UK.

The attack on Co-op was the third in a range of incidents to affect major UK retailers, with Marks and Spencer and Harrods also hit in recent days.

DragonForce told the BBC they were also responsible for other attacks, but apparently did not share any evidence proving this, and refused to elaborate.

How can I stay safe?

While it's still not yet known how accurate the DragonForce claims are, Co-op customers should be cautious over the next few days just to be on the safe side, and to get ahead of any repercussions if their information has been affected.

In an incident like this where it isn't clear what, if any, data has been affected - the first thing to do is to change your password linked to your Co-op account, as well as any other sites with the same credentials - we’ve put together a guide on how to create a secure password to make sure you’re as safe as possible.

The next, and probably most important step, is keeping vigilant. With your name and email address, a criminal can send sophisticated social engineering attacks, aimed to trick you into handing over more information, or into inadvertently downloading malware.

Make sure you double check any unexpected communications and email addresses - especially cross referencing these against the legitimate email addresses (these can be found on Google).

Be especially wary of any email that asks you to enter any information, click a link, or scan a QR code. Phishing attacks using QR codes are becoming more common, and are more dangerous than ever before, so make sure anything you scan is verified beforehand.

If a criminal does email you, there will most likely be signs. The first, is the email address the communication comes from - if it's G00gle or M1crosoft instead of their legitimate addresses, just delete the email. If you get an unexpected text, email, or phone call from anyone claiming to be a “friend”, from a number or address you don’t recognise, especially one that asks you to sign in, send money, buy a gift card, be very very suspicious.

You might also like

• Take a look at our picks for the best malware removal software around
• Check out our choice for best antivirus software
• M&S checkout chaos persists as cyberattack fallout continues