Committee publication · Correspondence · 22 May 2025

Letter from the Coop relating to the cyber-attack against the business, 18 May 2025

From: Business and Trade Sub-Committee on Economic Security, Arms and Export Controls

Summary

The Co-op Group declines the Business and Trade Sub-Committee's invitation to give evidence on its recent cyber-attack, citing ongoing recovery efforts and criminal investigations. The organisation acknowledges parliamentary interest and commits to providing evidence at a future point when it can best assist the committee without prejudicing criminal inquiries or aiding threat actors.

Key findings

The Co-op has experienced a 'highly sophisticated, organised and persistent criminal attack' and is undertaking significant protective and recovery action
The Co-op acknowledges potential lessons for UK economic security resilience but declines current evidence provision
The organisation commits to future testimony once recovery permits, subject to safeguards protecting criminal investigations and operational security

Tone

Procedural

Topics

cybersecurityeconomic-securitycritical-infrastructurecriminal-investigation

Key actors

Co-operative Group Limited, Shirine Khoury-Haq, Liam Byrne MP, Paul Gerrard, Business and Trade Sub-Committee on Economic Security, Arms and Export Controls

Notable line

“The Co-op has experienced a highly sophisticated, organised and persistent criminal attack and we continue to take significant action to protect the Co-op and recover the delivery of products …”

Key Quotes

“The Co-op has experienced a highly sophisticated, organised and persistent criminal attack and we continue to take significant action to protect the Co-op and recover the delivery of products and services members and customers rely on.”
— Paul Gerrard, Campaigns, Public Affairs and Policy Director, Co-op Group · describing the scale and nature of the cyber-attack

“… while we do not believe it would be helpful or possible to give evidence or provide further information in connection with the cyber-attack to the Committee at this point, we will, of course, be happy to do so at a point in the future”
— Paul Gerrard, Campaigns, Public Affairs and Policy Director, Co-op Group · explaining the refusal to give evidence and commitment to future assistance

“… any evidence and information we provide in the future to the Committee does not in any way prejudice any criminal investigations or provide information which may help malicious bad actors”
— Paul Gerrard, Campaigns, Public Affairs and Policy Director, Co-op Group · setting conditions for future evidence provision

View original document →

Source · parliament.uk record ↗