The Co-op cyber attack leaves millions of members at risk of scams and identity fraud for years, a leading cybersecurity expert has warned.
Professor Alan Woodward, of the Surrey Centre for Cyber Security at the University of Surrey, said members’ details could be sold on the dark web to scammers and fraudsters who could combine it with other hacked information to scam people.
“Data like that gets sold on,” said Prof Woodward, who has advised organisations including Europol on cybercrime. “So you might not suffer a loss immediately. But if someone’s got your name, address, telephone number, email address, they actually sell those kinds of details on to scammers.
“The scammers then use them for socially engineering you into anything from giving you their bank details to phishing attacks where you log in and give away your login credentials, that type of thing.”
The Co-op admitted on Friday that cyber criminals had stolen data on a “significant” number of its members, having previously claimed the attack only had a “small impact” on its operations.
The gang behind the attack told the BBC they had stolen the private information of 20m people who signed up to the Co-op’s membership scheme, though the retailer wouldn’t confirm the number.
The Co-op said hackers had accessed “personal data such as names and contact details, and did not include members’ passwords, bank or credit card details, transactions or information relating to any members’ or customers’ products or services with the Co-op Group.”
