The Co-op has shut down parts of its IT systems in response to hackers attempting to gain access to them.
It said the “proactive measures” it had taken to fend off the attack had had a “small impact” on its call centre and back office.
Meanwhile, the Metropolitan Police has confirmed it’s looking into the major cyber attack at fellow retailer Marks & Spencer (M&S).
“Detectives from the Met’s cyber crime unit are investigating,” it said in a statement.
It is unclear whether there is any link between the two incidents.
There are more than 2,500 Co-op supermarkets in the UK, as well as 800 funeral homes. It also provides food to Nisa shops.
A spokesperson confirmed its shops and funeral homes were operating as usual following the attempted hack.
“We are working hard to reduce any disruption to our services and would like to thank our colleagues, members, partners and suppliers for their understanding during this period,” they said.
“We are not asking our members or customers to do anything differently at this point.”
It comes as M&S enters the second week of a cyber attack that has caused chaos costing it millions of pounds in lost sales.
The retailer has not said what took out its online ordering systems and left empty shelves in stores.
Ciaran Martin, the founding Chief Executive of the National Cyber Security Centre (NCSC), told BBC Radio 4’s Today programme on Wednesday it had “serious” consequences for M&S.
“It is a highly disruptive event and a very difficult one for them to deal with,” he said.
Experts have told the BBC they believe the cyber attack affecting M&S is a result of ransomware called DragonForce.
Ransomware is malicious software which locks an owner out of their computer or network and scrambles their data – with the criminals demanding a fee to unlock it.
It is unclear whether the Co-op discovered the hacking attempt as a result of any extra security checks following the cyber attack on its high street rival.
Daniel Card, cyber expert at BCS, the chartered institute for IT, said it was “very rare” for a firm to take systems offline after an attempted hack.
He told the BBC a company taking its system offline like this generally indicated a “loss of control.”
Scott Dawson, head of payment processing firm Decta, said the hacking attempt “exposed alarming vulnerabilities” and should serve as a warning to others.
“Retailers can no longer afford to treat resilience as optional as this becomes more of a trend,” he said.
There have been similar hacking attempts on supermarket chains in the past, with Morrisons being impacted by an incident in December 2024.
M&S has reported its cyber attack to the National Cyber Security Centre (NCSC).
The BBC understands the body is urging other retailers to be vigilant.
An NCSC spokesperson said: “The NCSC routinely engages with a whole range of organisations about the cyber threats that the UK faces and regularly reminds them about the steps they can take to be as resilient as possible.”
