The Co-op has fallen into the red after it suffered an £80m hit to profits as a result of a “malicious” cyber-attack this year.
The group, which owns more than 2,000 grocery stores and more than 800 funeral parlours, was forced to shut down parts of its IT systems in April after it discovered an attempted hack.
Shoppers faced gaps on shelves as a result of the attack, while its funeral parlours had to operate some services via paper-based systems without access to digital services.
On Thursday, the retailer said it estimated the disruption lost it £206m in revenue, and hit its operating profit by £80m in the first half of its financial year. It now estimates a £120m hit to full-year profits as a result of the cyber-attack.
The chief financial officer, Rachel Izzard, told Reuters: “We believe the hit to the half year is £80m, we believe the hit for the full year is £120m and that’s inclusive of any [insurance] recovery.”
She added that the Co-op had limited insurance cover: “We had the front-end elements of cyber insurance in place in terms of the immediate response capabilities in the technology space for third parties but we don’t believe we will be claiming on insurance for back-end losses.”
Overall, revenue declined by 2.1% to £5.5bn and the group fell from a pre-tax profit of £58m in the first half of last year to a loss of £50m in the six months to 5 July.
The group’s chief executive, Shirine Khoury-Haq, said: “The cyber-attack highlighted many of our strengths. But more importantly, it also highlighted areas we need to focus on – particularly in our food business.
“We’ve already started on this journey, refining our member and customer proposition, making structural changes to our business, and setting our Co-op up for long-term success.”
The company’s chair said the first half of the year had “brought significant challenges, most notably from a malicious cyber-attack”.
While the attack occurred in April, the Co-op revealed in July that all 6.5 million of the mutual’s members had their data stolen in the attack. Khoury-Haq told the BBC at the time that she was “incredibly sorry” for the attack, in which names and addresses and contact information were obtained by hackers. She said no financial information, such as credit or debit card details, or transaction data, was stolen.
Robert Elsey, the chief digital and information officer at the Co-op, said the attackers gained access to the system via “social engineering”, a method used by cyber criminals to persuade, trick or threaten people into sharing information. He said the attack was “sophisticated” and “persistent”.
“They impersonated one of our colleagues,” he said. “As soon as that account was used maliciously or abnormally, our systems are designed to detect that.
“So, within minutes, our colleagues were shutting those accounts down. [The attackers] were very persistent and very capable, they were trying to re-enable accounts and then we blocked those as well.”
The attack on Co-op came just days after another cyber-incident at Marks & Spencer, which cost the retailer hundreds of millions of pounds. M&S also admitted that some personal details relating to thousands of customers, such as names, addresses, dates of birth and order histories, were taken.
The luxury department store Harrods was forced to shut down some systems after it was hit by a cyber-attack earlier this year.
The Co-op, which is headquartered in Manchester and employs 54,000 people, said it was still managing a “reducing level of cyber impact”. However, the group noted that it planned to open 30 new stores in the second half of its financial year, including food shops and franchise stores.
In July, the Co-op launched its first On the Go store in Solihull, near Birmingham, as it moves to challenge takeaway outlets such as Greggs, Pret a Manger and Subway.
