If you are no longer a Co-op member, you may still be affected and should check the contact details from your old membership. Co-op CEO Shirine Khoury-Haq confirmed hackers copied the full 6.5 million-member list during the April attack, as TechCrunch reported in its July account of the confirmation. Co-op is the UK retail co-operative whose members register contact details to shop and earn rewards. Leaving does not remove your old record from that stolen list, so your former inbox and home address matter most.
Table of Contents
- Did leaving Co-op remove you?
- What details were taken?
- How can former members pursue compensation?
- What should you check now?
Did leaving Co-op remove you?
No. Co-op admitted hackers accessed and extracted data from one system covering many current and past members, as Cyber Security News described in its early May report. That means a cancelled or lapsed membership can still leave your details exposed. Check the email you used to join, plus any older address you later replaced.
Also check the postal address on that membership. Scam mail or notices may go to an address you no longer monitor. If family members shared one membership, check their details too. A partner or child listed on the account may face the same contact-data risk.
What details were taken?
The stolen member data was names, addresses and contact information, as Grocery Gazette reported in its July report on the apology. Those fields are useful for phishing, impersonation and scam delivery messages. Co-op said passwords, bank or credit-card details, transactions and product holdings were not included.
That limit lowers direct account-takeover risk. It does not remove fraud risk from name-and-address exposure. Keep the distinction when you assess offers of help. A message asking for a password reset or card number does not match what Co-op said was stolen.
How can former members pursue compensation?
You claim against the organisation that lost the data, not against the regulator. Which? explains that the ICO cannot award compensation by law, though its view may support a claim, in its consumer-rights guidance. For a former member, that means directing the claim to Co-op. Keep proof of past membership, such as an old membership number, welcome email, or statement.
Save any breach notice sent to your old email or address. Do not wait for the regulator to pay you. Use its findings only as supporting evidence for your own claim. A solicitor or claims firm is optional, not required to start.
What should you check now?
Start with access and monitoring. Look through old inboxes for Co-op breach notices, password alerts and unfamiliar receipts.
Search for "Co-op membership," "dividend," and "rewards" to find the account name you used. Act on the old contact path first. Forwarders expire, inboxes close, and post gets returned, so update recovery details where you still can.
- Re-secure any old email still receiving Co-op mail with a strong, unique password.
- Watch bank statements and your credit report for unfamiliar applications.
- Follow Co-op updates from its official site or app.
- Treat unexpected breach calls, texts and emails as possible scams.