Written by Declan Thorpe – Cyberfort Information Security Consultant
Cyber incidents rarely begin with a clear warning. Most start with small signals, a login that doesn’t fit a pattern, a process running where it shouldn’t, a connection that looks out of place. The organisations that spot these signals early tend to have more options, more time and more control over what happens next.
The incident Co-op faced in April 2025 highlighted this reality. Public reporting shows that the organisation acted early, intervening before the attackers were able to move deeper into systems or attempt more damaging activity. Early intervention of this kind usually reflects an ability to recognise unusual activity quickly and understand enough about the situation to respond with confidence.
In a year marked by several high-profile retail cyber incidents, Co-op’s response stood out for its steadiness. The organisation acted early, demonstrating the value of understanding your environment well enough to recognise when something is out of place and intervene before the situation grows. The incident reinforced that visibility is more than a technical concept; it is a practical enabler of timely, confident decision-making that can meaningfully influence the trajectory of an incident.
A quick look at what happened
Co-op experienced a cyber-attack that resulted in unauthorised access to personal data belonging to a very large number of its members. Public reporting linked the activity to known threat actor group, DragonForce. While the attackers were able to copy certain data, they were prevented from moving deeper into systems or deploying destructive tools.
Co-op’s leadership later explained that the organisation had clear visibility of the attackers’ activity, describing it as being able to “see every mouse click.” That level of insight, based on what was publicly shared, helped the organisation understand what the attackers had accessed and how far the intrusion had progressed. This clarity supported the investigation and allowed decisions to be made based on observable activity rather than assumptions.
Even with early detection and containment, the attack created operational challenges. Stores experienced stock shortages, some customers encountered payment issues, and the organisation reported a noticeable financial impact. Additional one-off costs were incurred as part of the response and recovery effort.
Despite this, the outcome could have been significantly more severe. Early insight into the intrusion helped prevent escalation, reduce uncertainty and support a more controlled response. It also highlighted the value of understanding what is happening inside an environment before the situation accelerates.
Why this was really a story about visibility and early detection
The Co-op incident illustrated how much difference early detection makes during a cyber-attack. Many organisations focus on recovery, but this case highlighted the decisions that come before recovery even begins, the moment when something unusual is first noticed and teams need to decide what to do next.
Several practical realities became clearer.
Early detection gives organisations more time and more options
Spotting unusual activity early allows teams to intervene before attackers escalate their access or attempt more damaging actions. Time is one of the most valuable assets during an incident, and early detection effectively creates more of it.
Visibility doesn’t require a large budget
A fully staffed SOC is valuable, but not every organisation can afford one. What matters most is understanding your assets, knowing what “normal” looks like and having monitoring in place that highlights meaningful deviations. These fundamentals are achievable for organisations of all sizes.
Informed decisions depend on knowing your environment
When teams understand their systems, dependencies and typical behaviour, they can interpret signals more accurately and avoid acting on assumptions. Visibility supports clarity, and clarity supports better decisions.
Containment is most effective when guided by insight
Containment works best when teams know what the attacker has done and what they haven’t. That clarity comes from visibility, not guesswork. Early insight helps teams act with precision rather than disruption.
The incident showed that visibility is not just a technical capability, it is a foundation for better decision-making. When organisations understand what is happening early, they can respond with greater confidence and reduce the likelihood of a wider operational crisis.
What Organisations Can Learn and Apply Right Now
Incidents like the one Co-op experienced highlight how important it is for organisations to understand what is happening inside their environment before an intrusion has the chance to escalate. The lessons are not unique to retail, they apply across sectors, especially where operations and customer facing systems depend on accurate, timely insight.
The following areas stand out.
Know Your Assets
You cannot detect what you cannot see. Organisations benefit from:
- a clear, current view of their systems
- understanding which assets matter most
- awareness of where sensitive data lives
- visibility of external facing services
Asset visibility is the foundation on which detection capability is built, if you don’t know what is in your environment then you don’t know what you are protecting. It reduces blind spots and helps teams recognise when something is out of place.
Monitor What Matters
Monitoring does not need to be complex or expensive. What matters is:
- logging activity from key systems
- watching for unusual authentication patterns
- tracking changes to critical configurations
- alerting on deviations from expected behaviour
Even basic monitoring can surface early signals that something is wrong.
Establish Clear Escalation Paths
Early detection only helps if teams know what to do next. Organisations benefit from:
- simple, well understood escalation routes
- clarity on who investigates alerts
- thresholds for when to act
- confidence that raising a concern is the right thing to do
This turns visibility into action. It ensures that when something unusual is spotted, it does not sit unnoticed or unaddressed.
Use Early Insight to Guide Containment
Containment is most effective when informed by what you can see. Early insight helps teams:
- isolate affected systems
- prevent escalation
- avoid unnecessary disruption
- focus recovery efforts where they matter most
This is where visibility directly shapes the outcome. It allows containment to be targeted rather than broad, controlled rather than reactive.
Build Recovery on a Verified Safe Place
Recovery is easier and safer when systems remain intact, and the organisation has a clear view of the intrusion. Early detection helps preserve the conditions needed for:
- restoring from trusted backups
- validating system integrity
- reintroducing services safely
- avoiding reinfection
Safe recovery starts with early insight. When organisations understand what has happened, they can restore services with greater confidence and predictability.
Treat Visibility as a Resilience Capability
Visibility is not just a technical feature; it is a foundation for resilience. It enables:
- earlier intervention
- clearer decision-making
- more accurate scoping
- safer recovery
- reduced operational impact
Organisations that invest in visibility are better positioned to respond calmly and effectively when the unexpected happens. It is a capability that supports every stage of an incident, from detection to containment to recovery.
A more constructive way to look at It
The Co-op cyber-attack was disruptive, but it also highlighted where organisations can strengthen their resilience. It showed how early detection can shape the direction of an incident, and how understanding your environment supports more confident decision-making.
Incidents like this are not just challenges, they are opportunities to learn. They reveal where visibility can be improved, where monitoring can be strengthened and where preparation makes a meaningful difference. They also remind organisations that resilience is not built on a single control or a single team; it is built on the combined effect of awareness, clarity and the ability to act at the right moment.
For many organisations, the most important lesson is that early detection is achievable. It does not require a large security operation or complex tooling. It requires knowing your environment well enough to recognise when something is out of place, and having the confidence to act before the situation grows. That capability, the ability to notice, interpret and respond, is what turns a potential crisis into a manageable event.
The organisations that take these lessons on board tend to respond with greater confidence and experience less disruption when the unexpected happens. They invest in visibility not because it prevents every incident, but because it gives them the insight, they need to make better decisions under pressure. You need visibility, awareness and the ability to recognise when something isn’t right.
Seeing clearly, and seeing early, can change the entire trajectory of an incident.
For more information about Cyberfort security services contact us at [email protected] and one of our experts will be in touch.
Approved tools and when to use them.
Data rules – never input confidential or identifiable information into public models.
Oversight – who reviews outputs before publication.
Accountability – who owns AI risk in your organisation.
