Lessons from the Co-op's cyber attack: 'We yanked our own plug':

Russ Brady, director of group communications at the Co-operative Group, was in London on 25 April 2025 when he received a call from his chief risk officer and chief information officer alerting him that the diversified services group, with operations spanning food retail, insurance, legal advice and funerals, was under attack.

As Brady explained at the Corporate Affairs Summit, in a large matrix organisation such as the Co-op, its tech infrastructure should be thought of as an onion. ‘How far can the hackers get into the epicentre of the onion before they are detected, because if they get right the way in, and are able to plant ransomware, you’re in serious trouble,’ he said.

Crucially, the hackers were still at the outer layers when they were detected. The CIO took the decision to, as the hackers later put it, ‘yank their own plug’.

‘You’re creating self-harm, because you’re pulling the plug on your own infrastructure, but… if you know what you’re knocking down, then you’re going to be able to rebuild quicker,’ he explained. ‘The hackers wreaked havoc but we were fundamentally in control of our destiny, because we yanked our own plug and then had to rebuild from that.’

Simultaneously, the risk team set up an incident response unit, comprising gold command, effectively the operating board, and silver command, the key business units who sought to understand the impact on their operations and make strategic decisions accordingly.

‘But you can’t just allow individual businesses to make decisions in splendid isolation because the unintended consequences could actually hinder the macro progress you’re looking to make,’ said Brady. The teams needed to engage well with each other. ‘We also introduced a bronze level, which was more parochial… to manage those real localised issues as well.’

Brady’s deputy sat on silver command, while four of his team were on bronze command. ‘If you’ve got your team embedded in the right way, that serves to do two things. It helps the comms process to flow naturally but it also enables them to be that positive, challenging voice that is helping decision-making.’

While comms had a rehearsed cyber-attack playbook, Brady believes that there is also another role for the function to play in a crisis.

‘As a comms practitioner, you are not just there to practise your craft. You are there to enable others around you, who aren’t necessarily used to dealing with tense situations, face into them because there is a paralytic state that people can get into,’ he explained.

‘My team did a fantastic job for the Co-op, but they also helped calm people who were decision makers within the areas, allowing them to think. It’s a situation that no one can plan for. I’ve been through a few crises in my time. Every one is different. Every one brings its own challenges.’

He added: ‘I also guarantee that the playbook that you put in place will never be the playbook that you use because of the scenario that unfolds at the time. And, of course, because of what we’ve done and how we’ve rebuilt the business back differently, if it happened again, the impact would be different.’

Having taken the systems offline, the CIO had to bring them back online in a controlled manner. But difficult decisions had to be made. Which parts of the business could survive longer ‘on a manual basis’, and which ones needed to come back onstream swiftly.

The Co-op is the UK’s largest funeral provider, conducting roughly 1,800 funeral services a week. While it is not ideal to have food stores with empty shelves, it was unthinkable that any funeral service would be impacted.

‘Not a single funeral was interrupted in that period, which I think is simply incredible in this day and age. Our funeral service found a way… in some cases, it was a matter of reverting back to old school in terms of how funeral directors operated back in the 1950s,’ he said. ‘They had their own playbooks and their own ways of being able to operate.’

But, as Brady explained, it is hard to define a successful outcome at the start of a crisis like this, because so much rests on the technical teams. Within ‘three or four days’ the Co-op had a greater understanding of ‘what we were dealing with because we were in control, and we knew what we had to do,’ he explained. ‘You’ve got to go backwards to go forwards. We knew there was going to be some heavy lifting over the next two or three months.’

On 30 April, the Co-op publicly disclosed the attack, saying it had had a small impact on some back-office and call-centre services. ‘I’d made it, I guess, a point of principle that we were going to be as transparent as far as we could go,’ he said. ‘We weren’t, by the same token, going to give a running commentary on every single thing we were doing.’

Two decisions irked the hackers: pulling the plug, and refusing to engage with them. Shortly after the Co-op’s first statement, they contacted the BBC with proof they had infiltrated IT networks and stolen huge amounts of customer and employee data. Two weeks later, they angrily complained in messages to the BBC that the Co-op had ‘yanked their own plug’.  

The hackers’ claims sat awkwardly with the Co-op’s low-key first statement, but Brady defended it. ‘It was true at the time. There was no evidence. We were unable to prove one way or another [that customer data had been extracted].’

The timing of that statement was also shaped by the Co-op’s governance. Owned by 6.5 million members, the group has members on its board, and a 100-strong national members’ council ultimately holds it to account, so keeping members informed early was not optional.

While Brady, wearing an editorial hat, understood the news angle, he admitted to being conflicted about the decision to air interviews with criminals. ‘When [the hackers] realised that they weren’t going to get anything from us, it became: ‘How can we still come out of this with our brand being talked about?’ It’s a recruiting platform: if you give these hackers airtime and oxygen, you’re fuelling their own self-importance,’ he said.

Regardless of the hackers’ media strategy, the Co-op was working flat out to get back up and totally operational. ‘At a group level, we were looking at our eight business channels and thinking about how each, in their own right, is going to recover and in what time frame,’ he explained.

‘I’ve got a group responsibility to ensure its reputation is protected. But you’ve also got to see the constituent parts, how are they recovering and in what way. It’s almost like a Blue Peter chart, which is saying how far are we on that ladder to getting back?  Some business areas recovered remarkably quickly. Our food retail business was impacted the most because it is probably the most complex logistics operation in the UK, servicing more than 2,500 of our own stores in local communities, as well as 5,000 other stores.’

Fortuitously, the Co-op’s wholesale business operates separately to the core group infrastructure. ‘Our wholesale business did an amazing job during that period, not just in terms of supporting our own retail stores but supporting other Co-op partners as well as our independent retailers. The level of collaboration and cooperation that went on was fantastic.’

That collaboration was key across the group. As Brady pointed out: ‘Our success in handling it from a comms perspective was also down to our incident management process. It’s interesting how people forget how much symmetry there needs to be between a risk function and a corporate comms function, but the two have got to work closely together.’

Congratulations to the winners…

I had planned to write something intelligent and insightful about the CorpComms Awards the day after the ceremony.

But, alas, the celebrations got in the way. And my sofa appeared rather more attractive than my office chair on Friday, and then a family wedding in Ireland intervened. And finally a Microsoft outage prevented me from getting a sign-in code to my newsletter platform. Excuses. Excuses. Guinness

So, now that I’ve sufficiently recovered to string a sentence or two together, here are a few thoughts on the 19^th CorpComms Awards, in association with Unicepta.

Yes, that’s right. I can’t quite believe it, but it is almost two decades since the awards launched. In fact, these would have been the 20^th , but I paused the programme during lockdown to run a one-off online CovidComms Awards.

A lot has changed in that time. When we launched, there was no social media category because few companies were taking it seriously, and corporate websites were still relatively basic. Indeed, it was only a few years earlier that a company launching a website was considered a news story (albeit a short one).

Today, we’re awarding trophies for best social impact initiative, best GEO initiative and best use of AI, to name but a few, while the very definition of corporate affairs has expanded beyond recognition.

But one thing hasn’t changed: what makes a great piece of work.

The very best entries start with a clear objective. They identify what success looks like at the outset and then work to achieve that. It sounds simple, but it is surprising how many entries forget to do just that. Or report results that bear little relation to the objectives. (It’s 700 words, people; the judges don’t forget what they read two minutes ago!)

The big winner on the night was Lloyds Banking Group, which picked up trophies for a live event, its GEO work and best in-house team: corporate communications, as well as the ultimate trophy: the Grand Prix.

But other companies also shone. Electrical Safety First picked up trophies for The Beep, a TikTok highlighting the risk of ignoring a beeping smoke alarm, which led to a 15,800 per cent increase in searches for ‘how to test smoke alarms’ and its ongoing Battery Breakdown campaign, which every year stuns judges with its latest iteration. The media relations team at law firm Addleshaw Goddard received a gong, as did the internal comms team at BT.

Blurred was named Strategic Communications Agency of the year, and also picked up a trophy for its I Am Not A Typo campaign, which actually persuaded Microsoft to update its UK spellcheck! And Safina Mirza, managing director, marketing and communications at Canary Wharf Group, was named Communications Professional of the year.

There were plenty of trophies on the night, and the full list of winners can be viewed here. The rationale for choosing each of the the winners will shortly be available on our soon to be launched new website… and I may delve into one or two in the coming weeks.

And finally…

Speaking of the latest Microsoft outage, journalists at the BBC were tasked with finding out how different organisations were coping without email, they tried to make contact by phone… only to discover that most press offices now just offer an email address for journalists wishing to get in touch!