Major update as supermarket relaunches IT systems after cyber attack

The Sun

14-05-2025

A supermarket has issued a major update as it prepares to relaunch its IT system after a cyber attack.
The Co-op is set to turn online orders back on from today in a boost to shoppers.
1
A spokesperson for the supermarket told The Sun: 'Following the malicious third-party cyber-attack, we took early and decisive action to restrict access to our systems in order to protect our Co-op.
'We are now in the recovery phase and are taking steps to bring our systems gradually back online in a safe and controlled manner.'
They added that 'we have switched all our orders back to the normal supply processes and systems'.
The move will see stock levels return to normal in the coming days after the retailer faced widespread shortages over the past few weeks.
There will be more items available in Food stores and online from this weekend.
The Co-op also confirmed that it is working closely with its suppliers to restock its stores.
Shoppers have seen large gaps on Co-op shelves after the retailer was targeted by cyber criminals on April 30.
Customers have complained of shortages of fresh produce, ready meals, yoghurts and confectionery.
The attack also pushed contactless card payments offline in nearly one in ten stores, which forced customers to pay with cash or enter their PINs at the till.
The Co-op has confirmed that all forms of payments including contactless, and chip and pin are now working across all of its stores.
All iPhone and Android users must switch on two settings to stop bank-raiding attack – worrying sign means it's too late
The news comes after the retailer was forced to close part of its IT system following the attempted cyber attack.
This included restricting access to certain systems, impacting some back office functions and call centre services.
A fortnight ago the Co-op confirmed that some customers have had their private data stolen in the cyber attacks.
Personal details such as names, contact information and dates of birth of a 'significant number' of customers and past members were compromised, the chain said.
What is a cyber attack?
A CYBER attack is any deliberate attempt to disrupt, damage, or gain unauthorised access to computer systems, networks, or digital devices.
These attacks can target individuals, businesses, or even governments, and their motives can range from financial gain to political disruption.
Cyber attacks can take many forms, employing various techniques to achieve their malicious goals.
Common types of cyber attacks include:
Malware: Malicious software designed to damage or gain control of a system. Examples include viruses, worms, ransomware, and spyware.
Phishing: Deceptive attempts to trick individuals into revealing sensitive information such as usernames, passwords, or credit card details, often through fake emails or websites.
Denial-of-Service (DoS) Attacks: Flooding a network or server with traffic to overwhelm its resources and make it unavailable to legitimate users.
SQL Injection: Exploiting vulnerabilities in website databases to gain unauthorised access to data.
Ransomware: Malware that encrypts a victim's data and demands a ransom for its release.
Social Engineering: Manipulating individuals into performing actions or divulging confidential information.
But members' passwords, credit card details and transaction information were not stolen.
Cyber criminals managed to extract the data from one of the shop's systems, forensic investigations revealed.
The National Crime Agency and National Cyber Security Centre are investigating the breach.
The true scale of the damage only became clear after hackers contacted the BBC with evidence they had stolen customer data.
Customers were assured that the Co-op has implemented measures to 'minimise disruption'.
In a statement the company said: 'We appreciate that our members have placed their trust in our Co-op when providing information to us.
"Protecting the security of our members' and customers' data is a priority, and we are very sorry that this situation has arisen."
What has happened at M&S?
The Coop is not the only retailer to be hit by a cyber attack.
M&S has been experiencing significant disruption after a cyber incident which has affected contactless payments, click-and-collect services and online orders.
The problems started on April 19, when customers reported that they were unable to collect purchases or return items.
On April 21 M&S acknowledged the attack and apologised for the inconvenience.
It engaged cyber security experts and notified the National Cyber Security Centre and the Information Commissioner's Office.
The criminals suspected behind the attack are known as 'Scattered Spider' and have become one of the most prolific cybergangs of the past 18 months.
They specialise in ransomware - a type of attack that is designed to steal information or access in exchange for a sum of money.
They have built a reputation for targeting large, customer-facing organisations through social engineering and identity-focused tactics.
Jamie Akhtar, CEO and Co-founder at CyberSmart, told The Sun: "This is a group known not for sheer technical sophistication, but for their ability to manipulate access, often by impersonating employees or exploiting multi-factor authentication systems."
Despite M&S's efforts to restore systems, disruption continued throughout the week.
The retailer was forced to suspend online and app orders on April 24.
As a result, the company's share price tumbled by 5%.
Shoppers then began to report empty shelves in some stores as the cyber incident affected stock levels.
Customers complained they were unable to get their hands on bananas, fish and Colin the Caterpillar cakes.
When questioned, staff said the disruption was linked to the cyber attack.
Yesterday Jane Wall, the head of customer service at M&S, contacted customers to let them know what the cyber attack means for them.
She confirmed that some personal customer data has been taken but there is no evidence that it has been shared.
This data could include contact details, date of birth and online order history.
But she said it does not include usable card or payment details or account passwords.
She warned customers that they may receive emails, calls or texts fraudulently claiming to be from M&S so customers must be vigilant.
She added: 'We sincerely apologise for any inconvenience caused to you and all of your customers.
'Thank you so much for shopping with us and for your support, we never take it for granted.'
Timeline of cyber attack
Saturday, April 19: Initial reports emerge on social media of problems with contactless payments and click-and-collect services at M&S stores across the UK. Customers experience difficulties collecting online purchases and returning items due to system issues.
Monday, April 21: Problems with contactless payments and click-and-collect persist. M&S officially acknowledges the "cyber incident" in a statement to the London Stock Exchange. CEO Stuart Machin apologises for the disruption and confirms "minor, temporary changes" to store operations. M&S notifies the National Cyber Security Centre (NCSC) and the Information Commissioner's Office (ICO) and engages external cybersecurity experts.
Tuesday, April 22: Disruptions continue. M&S takes further systems offline as part of "proactive management".
Wednesday, April 23: Despite earlier claims of customer-facing systems returning to normal, M&S continues to adjust operations to maintain security. Contactless payments are initially restored, but other services, including click-and-collect, remain affected.
Thursday, April 24: Contactless payments and click-and-collect services are still unavailable. Reports surface suggesting the attackers possibly gained access to data in February.
Friday, April 25: M&S suspends all online and app orders in the UK and Ireland for clothing and food, although customers can still browse products. This decision leads to a 5% drop in M&S's share price.
Monday, April 28: M&S is still unable to process online orders. Around 200 agency workers at the main distribution centre are told to stay home.
Tuesday, April 29: Information suggests that the hacker group Scattered Spider is likely behind the attack. Shoppers spot empty shelves in selected stores.