The Co-op cyber attack means 20million members are now at risk of being involved in scams and identity fraud for years.
A leading cyber security expert has warned that members’ details could be sold on the dark web to fraudsters who could combine it with various hacked information to scam people.
‘You might not suffer a loss immediately,’ Professor Alan Woodward, of the Surrey Centre for Cyber Security at the University of Surrey told The Telegraph.
‘But if someone’s got your name, address, telephone number, email address, they actually sell those kinds of details on to scammers.
‘The scammers then use them for socially engineering you into anything from giving you their bank details to phishing attacks where you log in and give away your login credentials, that type of thing.’
Professor Woodwad, who has advised organizations including Europol on cybercrime stressed that scammers are becoming more sophisticated and use personal information to gain trust with their victims.
He added that those whose information had been compromised would probably not receive any compensation despite being left vulnerable to scams and identity theft.
The Co-op admitted that a criminal group, calling itself DragonForce had infiltrated the company’s IT network and stolen both customer and employee data in a cyber attack on Wednesday.
The National Crime Agency (NCA) said it is investigating the attacks individually but are ‘mindful they may be linked’ (file image)
The Co-op admitted that a criminal group had infiltrated the company’s IT network and stolen both customer and employee data in a cyber attack on Wednesday (file image)
Co-op conceded ‘personal data such as names and contact details’ had been taken from its membership scheme after the devastating scale of the attack was revealed.
The ransomware group are seeking to extort money from the company, but have not said what they would do with the data if they do not get paid.
DragonForce has also claimed responsibility for the ongoing attack on M&S and an attempted hack of Harrods, the BBC said.
The National Crime Agency (NCA) said it is investigating the attacks individually but are ‘mindful they may be linked’.
A Co-op spokesman said: ‘As a result of ongoing forensic investigations, we now know that the hackers were able to access and extract data from one of our systems.
‘The accessed data included information relating to a significant number of our current and past members.
‘This data includes Co-op Group members’ personal data such as names and contact details, and did not include members’ passwords, bank or credit card details, transactions or information relating to any members’ or customers’ products or services with the Co-op Group.
‘We have implemented measures to ensure that we prevent unauthorised access to our systems whilst minimising disruption for our members, customers, colleagues and partners.
The Co-op cyber attack means millions of members are now at risk of being involved in scams and identity fraud for years (file image)
‘We appreciate that our members have placed their trust in our Co-op when providing information to us. Protecting the security of our members’ and customers’ data is a priority, and we are very sorry that this situation has arisen.’
The retail giant, with more than 2,500 supermarkets, 800 funeral homes and an insurance business, initially downplayed the attack by saying it had ‘pre-emptively’ shut down parts of its IT network after detecting an attempted breach.
But the anonymous hackers behind DragonForce contacted the BBC with evidence of databases they had accessed, containing the user names and passwords of all employees, as well as customer membership card numbers, their names, home and email addresses and phone numbers.
The BBC said hackers sent the first extortion message to Co-op’s head of cyber security in an internal Microsoft Teams chat on April 25. The message read: ‘Hello, we exfiltrated the data from your company. We have customer database, and Co-op member card data.’
The hackers say they also messaged other members of the executive committee as part of their scheme to blackmail the firm.
Co-op has been contacted for further comment.
