The Co-operative’s trading update shows the financial effect of a cyber attack last year against the retailer. Last year, revenue was down 2.3pc compared to the previous year; ยฃ11,025m in 2025 compared to ยฃ11,279m in 2024. The retailer gave a figure of ยฃ107m for the ‘impact to profitability’; it recorded a loss of ยฃ35m last year compared with profits of ยฃ131m the year before.
The Co-op (Cambridge store, pictured) said its immediate priority is on resuming its 2024 trajectory, where results demonstrated a 35pc increase in underlying operating profit.
Debbie White, Chair of Co-op Group, described 2025 as a challenging year, ‘but those challenges have helped us reshape Co-op for the future. Despite a cyber attack and tough market conditions, our colleagues have shown incredible resilience, keeping communities served and essential services running.’
Comment
Oliver Spence, CEO of CybaVerse said: “For years, cyber risk has been treated as a technical problem sitting somewhere in IT. What incidents like this show is that itโs a direct financial risk to the business, capable of wiping out entire quarters of profit in one hit. A ยฃ100m-plus impact isnโt an edge case anymore. Itโs what happens when operational dependency on technology outpaces an organisationโs ability to detect, respond and recover from attacks in real time.
Matt Knell, UK Country Manager at ESET, said: โIf the JLR attack showed us anything, itโs how quickly a cyber incident can shut down production at scale and have major consequences for the business and the wider economy. The real challenge is that many organisations still treat cybersecurity as an IT issue rather than a strategic business decision. When it sits outside the boardroom, itโs harder to prioritise appropriately.
โWhatโs striking is that many organisations still see reactive approaches as more economical, despite the evidence to the contrary. With many major incidents resulting in six-figure losses and widespread operational disruption, the cost of reacting after the fact can be significant. In contrast, investing in advanced endpoint protection and managed detection and response (MDR) services can provide continuous, 24/7 monitoring and access to specialist expertise, helping organisations stay ahead of evolving threats, even when internal teams are stretched, In that context, the idea that prevention is too expensive simply doesnโt stand up.
โThe organisations that get ahead of this will be the ones that treat cybersecurity as a core part of how they run the business, not just something for IT to manage.โ
