Co-op fends off hackers as police probe M&S cyber attack

The Co-op has shut down components of its IT techniques in response to hackers making an attempt to achieve entry to them.

It mentioned the “proactive measures” it had taken to fend off the assault had had a “small affect” on its name centre and again workplace.

In the meantime, The Metropolitan Police has confirmed it is trying into the foremost cyber assault at fellow retailer Marks & Spencer (M&S).

“Detectives from the Met’s cyber crime unit are investigating,” it mentioned in a press release.

It isn’t recognized whether or not there may be any hyperlink between the 2 incidents.

There are greater than 2,500 Co-op supermarkets within the UK, in addition to 800 funeral properties. It additionally offers meals to Nisa retailers.

A spokesperson confirmed its retailers and funeral properties had been working as traditional following the tried hack.

“We’re working laborious to scale back any disruption to our companies and want to thank our colleagues, members, companions and suppliers for his or her understanding throughout this era,” they mentioned.

“We’re not asking our members or prospects to do something in another way at this level.”

It comes as M&S enters the second week of a cyber attack that has triggered chaos costing it tens of millions of kilos in misplaced gross sales.

The retailer has not mentioned what took out its on-line ordering techniques and left empty cabinets in shops.

Ciaran Martin, the founding Chief Govt of the Nationwide Cyber Safety Centre (NCSC), instructed the At this time programme on BBC Radio 4 on Wednesday it had “critical” penalties for M&S.

“It’s a extremely disruptive occasion and a really tough one for them to take care of,” he mentioned.

Consultants have instructed the BBC they consider the cyber assault affecting M&S is a results of ransomware known as DragonForce.

Ransomware is malicious software program which locks an proprietor out of their laptop or community and scrambles their knowledge – with the criminals demanding a charge to unlock it.

It isn’t recognized whether or not the Co-op found the hacking try because of any additional safety checks following the cyber assault on its excessive avenue rival.

Daniel Card, cyber skilled at BCS, the chartered institute for IT, mentioned it was “very uncommon” for a agency to take techniques offline after an tried hack.

“Taking techniques offline is usually indicative of both a lack of management or to defend towards a zero day the place no patch is accessible,” he mentioned.

A “zero day” is a time period for a vulnerability in a pc system which its house owners do not learn about – that means anyone can exploit it.

There have been comparable hacking makes an attempt on grocery store chains up to now, with Morrisons being impacted by an incident in December 2024.

In the meantime, the banks Barclays and Lloyds had been hit by outages earlier in 2025.