The Decision No CISO Rehearses Without Discomfort
May 2025. The Co-op Group's security operations team detected anomalous activity consistent with an active intrusion — lateral movement patterns that, three weeks earlier, had preceded the DragonForce ransomware deployment across Marks & Spencer's infrastructure. The Co-op's incident response team faced the decision that incident response playbooks describe clinically but that carries enormous operational weight in practice: initiate a proactive system shutdown that causes immediate, visible disruption, or attempt to contain the threat without taking down production systems and risk a ransomware deployment on the attacker's timeline rather than your own.
The Co-op chose the shutdown. Back-office and disaster recovery systems were taken offline. Member-facing services were degraded. The move was widely characterised as a response that limited the ransomware impact — and in a narrow technical sense, this is accurate. DragonForce ransomware was not deployed at the scale that hit M&S. But the cost of that outcome was not zero. The Co-op's own systems were down. Operations were disrupted. Members were affected. And critically: the data had already been exfiltrated before the shutdown was initiated.
DragonForce published content on their leak site demonstrating possession of Co-op Group customer data — approximately 20 million records including member names, contact details, and Co-op membership information. The proactive shutdown stopped the encryption. It did not stop the exfiltration that had occurred during the attacker's dwell period before detection. By the time the Co-op's security team identified the intrusion, the data was already out. This is the timeline reality of modern double-extortion ransomware that every organisation's incident response plan must account for.
The Same Playbook, Three Weeks Later, Three Targets in Six Weeks
The Co-op attack was not an independent campaign. It was the same DragonForce/Scattered Spider operator cluster, using the same social engineering initial access methodology, targeting a second major UK retailer within three weeks of the M&S incident. During the same approximate campaign window, Harrods — the Knightsbridge luxury retailer — also reported an attempted intrusion. Harrods restricted internet access and prevented the attack from progressing, but confirmed the attempt was made.
M&S in April. Co-op in May. Harrods in May. Three major UK retailers targeted by the same actor cluster using the same methodology within six weeks. This is systematic sector reconnaissance, not opportunistic scanning. Scattered Spider affiliates had identified UK retail as a target-rich environment with a uniform vulnerability: IT service desk caller verification procedures that had already proven bypassable at M&S, replicated with minor variation across the sector.
The three-week gap between M&S and Co-op attacks represents the time needed to conduct reconnaissance on the next target, establish initial access, complete lateral movement sufficient to stage the attack, and exfiltrate data before timing the deployment. The M&S incident disclosure did not trigger sector-wide defensive procedure changes fast enough to prevent Co-op being compromised using the same methodology. The institutional response cycle — incident occurs, guidance issued, organisations update procedures — runs slower than the attacker iteration cycle. Organisations that wait for sector guidance to trigger defensive upgrades are permanently one step behind.
Twenty Million Records: The Exfiltration That Precedes the Encryption
The data exfiltrated from Co-op — approximately 20 million customer records — illustrates the evolution in ransomware operator tactics that organisations have been slow to incorporate into data protection strategies. Modern ransomware groups do not simply encrypt data and demand payment for the decryption key. They exfiltrate data first, then encrypt, creating a double-extortion position: pay to recover access via decryption, and pay separately to prevent publication of the stolen data. Two revenue streams from a single intrusion.
For Co-op, this meant that even after the proactive shutdown limited the ransomware deployment, the exfiltration had already succeeded independently. Twenty million member records — names, contact details, membership data — could not be recovered by taking systems offline. They could not be destroyed by paying a ransom. DragonForce's publication of proof-of-data on their leak site was a demonstration of leverage, not a negotiating position. The exfiltration had succeeded regardless of what happened to the encryption phase.
For Co-op members, the downstream risks are those that attach to any large-scale contact data exposure: targeted phishing campaigns using legitimate-looking Co-op communication templates, SIM-swapping attempts against mobile numbers in the dataset, and credential-stuffing attacks against email addresses from the breach. The Co-op's notification obligations under UK GDPR required disclosure to affected individuals and the Information Commissioner's Office — triggering regulatory scrutiny that will extend for months beyond the operational incident's resolution.
Proactive Shutdown: The Right Call, and What It Reveals
The Co-op's decision to proactively shut down systems ahead of ransomware deployment was the correct incident response decision given the circumstances at the point of detection. It limited the encryption blast radius, preserved backup infrastructure for recovery, and reduced the total operational recovery timeline relative to what M&S experienced. Security practitioners who characterise the proactive shutdown as a failure because it caused self-inflicted disruption are using the wrong comparison baseline. The relevant counterfactual is not 'what if the shutdown had not happened.' It is 'what if DragonForce had deployed at full scale on their own timeline.'
However: the necessity of proactive shutdown reflects a failure that occurred earlier in the attack chain. The relevant question is not whether the Co-op made the right call at the moment of detection. They did. The relevant question is why detection occurred after exfiltration had already succeeded, rather than during initial access or during the lateral movement phase that preceded it.
NTLM hash extraction, anomalous Active Directory enumeration, unusual volume of privileged remote access sessions, lateral movement to backup and DR infrastructure — these are all detectable signals in an environment with properly tuned SIEM correlation rules and adequate endpoint telemetry. The Co-op's team detected the intrusion. Earlier detection — during initial access or lateral movement — would have changed the outcome. Data would not have been exfiltrated. The choice between encryption blast radius and self-imposed shutdown would not have been necessary.
The UK Retail Wave: What Sector Campaigns Mean for Every CISO
M&S in April. Co-op in May. Harrods in May. Three attacks in a single campaign window, same actor cluster, same initial access methodology, three of Britain's most prominent retailers. The pattern removes any ambiguity about whether this was opportunistic targeting. It was a structured sector campaign with pre-identified victims, pre-positioned social engineering scripts, and demonstrated willingness to move to the next target within days of the previous operation commencing.
For UK retail CISOs and risk officers, the sector campaign framing has direct implications for defensive posture. The threat is not 'ransomware groups that may target retail.' It is a specific, identified actor cluster that has demonstrated active intent and operational capability against named UK retail targets, and that is iterating on the same social engineering initial access methodology across multiple victims without triggering a defensive response fast enough to prevent the next attack.
Organisations that were not in the M&S-Co-op-Harrods compromise set were not protected by post-incident guidance. They were protected by controls that existed before the guidance was issued. The difference between a compromised UK retailer in May 2025 and an uncompromised one was not sector guidance. It was whether the organisation had already implemented hardware-backed caller verification at the IT service desk, lateral movement detection tuned to Scattered Spider operational patterns, and immutable backup infrastructure that ransomware operators cannot reach.