The Co-op has revealed its cyberattack will end up costing £120m in lost profits this year, after shoppers were faced with empty shelves and payment issues.
Co-op’s sales fell by £206m due to the attack as it forced the retailer to shut down parts of its supply chain and logistics network.
This translated to a £80m hit to profits in the first half of the year with the retailer expecting a further £40m in losses through the second half as it faces recovery costs and sees volumes gradually return.
The group consequently fell to an overall loss of £50m for the six months to 5 July, compared with a £58m profit a year earlier.
In July, CEO Shirine Khoury-Haq revealed all 6.5 million of the group’s members had their data stolen in the attack.
“The cyberattack highlighted many of our strengths. But more importantly, it also highlighted areas we need to focus on – particularly in our food business,” said Khoury-Haq.
“We’ve already started on this journey, refining our member and customer proposition, making structural changes to our business, and setting our Co-op up for long-term success.”
The cyberattack meant the group’s revenue fell 2% to £5.5bn, although without the disruption it would have grown 1.5% – in line with last year’s trend.
In food, its volumes excluding the cyberattack were flat, with sales growth driven by rising prices in line with the market, Co-op said.
“The first half of 2025 brought significant challenges, most notably from a malicious cyberattack,” said chair Debbie White.
Despite the recovery, the group still plans to open 30 new stores in the second half of the year, including food shops and franchise stores.
M&S revealed in May it was expecting a £300m hit to profits due to a cyberattack that affected both online orders and in-store availability.
Analysts warned at the time the Information Commissioner’s Office, responsible for data protection regulation, could hit the retailer with a major fine. The maximum penalty is £17.5m or 4% of annual turnover, whichever is higher.
Four people were arrested in July in connection with the cyberattacks at both Co-op and M&S.
No comments yet