The Co-op has apologised after hackers managed to access the data of a “significant number” of past and current members.
The firm said the compromised data included names and contact details but not passwords or bank and credit card details.
It said it was “continuing to experience sustained malicious attempts”.
The National Cyber Security Centre (NCSC) and the National Crime Agency (NCA) are helping the company investigate.
👉 Listen to Sky News Daily on your podcast app 👈
A spokesperson described it as a “highly complex situation” and said it had “implemented measures to ensure that we prevent unauthorised access to our systems”.
“As a result of ongoing forensic investigations, we now know that the hackers were able to access and extract data from one of our systems,” said a statement.
What is going on with the retail cyber attacks?
M&S pauses recruitment amid ongoing cyber attack
Who are Scattered Spider? How the notorious hackers linked to M&S cyber attack work
“The accessed data included information relating to a significant number of our current and past members.”
It said the data compromised also did not include information on customer transactions or products and services someone may have with Co-op Group.
“We appreciate that our members have placed their trust in our Co-op when providing information to us,” said the spokesperson.
“Protecting the security of our members’ and customers’ data is a priority, and we are very sorry that this situation has arisen.”
Co-op membership is an opt-in scheme that offers discounts and other benefits.
Follow our channel and never miss an update
Read more from Sky News:
Who are Scattered Spider?
Prince Harry: ‘I don’t know how much longer my father has’
It comes as M&S and luxury retailer Harrods were also struck by cyber attacks this week.
On Monday, hundreds of M&S agency workers at its main distribution centre were told to stay at home as it grappled with the attack.
Shoppers also complained of empty shelves as M&S confirmed “pockets of limited availability in some stores” due to measures to manage the incident.
The company has also paused recruitment and temporarily taken down its online recruitment pages.
