The Co-operative Group DIGITAL

Target: The Co-operative Group Limited Research date: 23 October 2026 Evidence period: 2020–2026, with earlier relationship history where documented Scope: Enterprise technology, surveillance, cloud infrastructure, data processing, defence-sector relationships, AI and technology ecosystem activity.

Enterprise Technology Stack & Vendor Relationships

Enterprise cloud and systems integration

On 21 February 2024, Tata Consultancy Services (TCS) announced an expansion of its approximately 14-year relationship with The Co-operative Group, covering a cloud-first infrastructure strategy and migration from traditional data centres to TCS Enterprise Cloud. TCS described previous work involving retail transformation, core systems and franchise programmes. The historical relationship began around 2010 [pre-2020], while the expansion was expressly documented in 2024.¹

The 2024 agreement identified TCS Enterprise Cloud as a managed enterprise infrastructure platform, making the relationship relevant to core business infrastructure rather than an isolated retail application. The announcement did not identify an Israeli hosting location, Israeli subcontractor or Israeli-origin technology component.¹

A supplier case study separately describes Co-op operating SAP on Microsoft Azure and using Microsoft Power BI to analyse consumer behaviour and improve product allocation across stores. The source refers to projected savings by 2022, establishing historical implementation evidence but not the configuration of the production environment as of October 2026.²

No public evidence identified establishing that the TCS engagement or documented Microsoft Azure/SAP environment uses Israeli-hosted infrastructure, Israeli-origin cybersecurity products or an Israeli technology integrator.

Retail transaction infrastructure

In September 2020, Co-op expanded its partnership with Diebold Nixdorf to include managed services and remote monitoring of self-service and point-of-sale equipment. The arrangements involved DN AllConnect Services for Retail and IoT-based operational monitoring, with the supplier reporting remote resolution of approximately 80% of maintenance tickets and 99% system availability.³

Diebold Nixdorf’s customer case study describes the BEETLE/M-III point-of-sale platform, displays, iScan EASY self-checkout terminals and managed availability services. The documented relationship covers operationally significant customer transaction systems across Co-op’s retail estate.⁴

In February 2026, Co-op introduced dual-screen flexi-checkouts supplied by Diebold Nixdorf, with a planned rollout to 150 stores by April 2026. Contemporary reporting identified the checkout software as developed by Co-op’s own technology teams.⁵

The 2026 programme provides evidence of continued commercial engagement with Diebold Nixdorf after 19 July 2024 and November 2024. The documented transaction does not establish an Israeli technology supply relationship.⁵

Israeli-origin enterprise software

No public evidence identified of a direct licensing, procurement or integration relationship between Co-op and Check Point, Wiz, CyberArk, SentinelOne, NICE, Verint, Claroty, Palo Alto Networks or another specifically identifiable Israeli-origin cybersecurity vendor.

No public evidence identified that TCS, Microsoft or Diebold Nixdorf deployed Israeli-origin technology specifically for Co-op.

Procurement intermediaries

The Co-op relationship with TCS involves infrastructure transformation, while Diebold Nixdorf supplies managed retail systems and The Marketing Lounge Partnership operates certain Co-op-associated digital services. These are separately documented commercial arrangements; their disclosures do not establish Israeli technology subcontracting.^{1, 4, 6}

No public evidence identified of an authorised Israeli reseller, distributor or intermediary supplying technology to Co-op.

Surveillance, Biometrics & Retail Technology

Retail AI surveillance

Co-op’s 2024 interim reporting confirms an AI analytics trial across 14 stores during the first half of 2024. The system was designed to detect concealment, theft and physical assaults, with alerts transmitted to a Mitie monitoring station.⁷

Independent reporting in September 2024 described security technology trials intended to identify theft, concealed weapons and assaults on retail workers. The reporting distinguished the AI security trial from facial-recognition processing and identified Mitie as the monitoring partner.⁸

The available disclosures identify Mitie as the monitoring partner but do not identify the developer of the AI analytics software.^{7, 8}

No public evidence identified attributing the 2024 AI surveillance system to Trigo, BriefCam, AnyVision/Oosto, Trax or another Israeli-origin technology company.

Biometric age estimation

In June 2022, Diebold Nixdorf announced that Co-op was testing Vynamic Smart Vision I Age Verification, incorporating Yoti age-estimation technology, at five Manchester stores. The trial was scheduled to conclude on 30 June 2022 and formed part of the UK Home Office Digital ID Sandbox.⁹

Co-op’s published Age Scan explanation describes optional camera-based facial age estimation at self-checkouts. The system estimates whether customers are old enough to purchase age-restricted products, without using facial recognition to establish identity.¹⁰

The documented age-estimation trial provides evidence of biometric image analysis for retail age assurance, but the reviewed sources do not establish a commercial relationship with an Israeli-origin biometric supplier.^{9, 10}

No public evidence identified confirming continued operation of this specific age-estimation trial as of October 2026.

Retail crime intelligence and facial recognition

February 2024 reporting described Project Pegasus, under which participating major retailers provided CCTV images for police-assisted identification of prolific offenders. Reporting concerning Co-op separately discussed the company’s retail security operations and police engagement.¹¹

September 2024 reporting linked Co-op to Project Pegasus and described a distinction between its retail AI security trial and the use of facial recognition within police-supported crime intelligence arrangements.⁸

The reporting does not establish that Co-op directly operated an Israeli-origin facial-recognition product or identify the software provider responsible for any subsequent police matching.^{8, 11}

No public evidence identified of Israeli-origin predictive policing, gait recognition, sentiment analysis or workforce surveillance systems being deployed by Co-op.

Third-party deployment

The confirmed Mitie, Diebold Nixdorf and Yoti relationships demonstrate that Co-op uses third-party technologies for retail operations, monitoring and age estimation. The reviewed disclosures do not identify an Israeli-origin surveillance component within those relationships.^{4, 7, 9}

No public evidence identified of Israeli surveillance software being delivered indirectly through these providers.

Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

Documented cloud infrastructure

TCS announced its planned transition of Co-op infrastructure from conventional data centres to a managed environment using TCS Enterprise Cloud in February 2024. The announcement identified infrastructure modernisation and managed cloud services but did not disclose individual hosting regions.¹

Separately, the historical Azure/SAP case study documents enterprise analytics using SAP, Microsoft Azure and Power BI. The publicly described arrangement does not establish that Co-op data was stored or processed in Israel.²

No public evidence identified that Co-op operates, leases or co-locates a data centre in Israel.

Customer data collection and processing

Co-op’s privacy notice confirms processing of customer identity, membership, transaction, interaction, payment, communication and CCTV information. It also describes personalised offers based on shopping behaviour and information sharing with service providers, group companies, advertising partners and public authorities where applicable.¹²

The privacy notice identifies Google and other digital advertising platforms as potential recipients of information used for audience matching and advertising activities. This establishes commercial data-sharing arrangements but does not establish processing within Israeli jurisdiction.¹²

Co-op’s privacy notice permits certain transfers of personal information outside the European Economic Area and describes safeguards for international transfers. It does not identify Israel as a processing destination or disclose a comprehensive map of cloud hosting locations.¹²

A separate privacy notice for a Co-op-associated insurance service identifies The Marketing Lounge Partnership Limited as a data processor. It states that relevant service information is primarily hosted in the United Kingdom, with specified exceptions involving other services and jurisdictions.⁶

The Marketing Lounge Partnership’s additional service notice describes the collection of personal identifiers and acknowledges possible international data transfers in defined circumstances. These disclosures do not identify Israeli processing infrastructure.¹³

Data-exposure jurisdiction

The documented processing activities include customer behavioural analytics, retail transaction systems, membership information and security monitoring. Publicly available disclosures do not establish that any of these specific Co-op data pipelines are hosted, routed, processed or legally controlled through Israeli infrastructure.^{2, 7, 12}

No public evidence identified of Co-op customer information being processed in an Israeli data centre or under a documented Israeli government access arrangement.

Israeli government cloud participation

No public evidence identified of Co-op participating in Project Nimbus or another Israeli government cloud procurement programme.

No public evidence identified of Co-op providing sovereign-cloud, data-residency or infrastructure-resilience services to Israeli state institutions.

No public evidence identified of cloud infrastructure supplied by Co-op to Israeli defence or intelligence organisations.

Defence, Intelligence & Security Sector Technology Relationships

Military and intelligence contracts

No public evidence identified of technology contracts between The Co-operative Group and the Israel Defence Forces, Israeli Ministry of Defence, Israeli intelligence agencies or Israeli security authorities.

No public evidence identified of a Co-op technology reseller or integrator delivering its products or services to those institutions.

Dual-use technology

Co-op’s documented use of AI retail security monitoring and customer analytics establishes commercial applications of general-purpose digital technology in UK retail operations. The associated disclosures identify loss prevention, store security and retail optimisation as the relevant applications.^{7, 2}

No public evidence identified of those technologies being provided by Co-op for Israeli military, intelligence or law-enforcement operations.

Offensive cybersecurity and digital weapons

No public evidence identified of Co-op developing, selling, licensing or maintaining offensive cyber tools, exploit platforms or digital weapons systems.

No public evidence identified of Co-op technology being used for offensive cyber operations by Israeli state actors.

Constructive notice

The February 2024 TCS infrastructure agreement predates 19 July 2024, while Diebold Nixdorf’s February 2026 checkout programme documents a continuing technology supplier relationship after that date and after November 2024.^{1, 5}

No public evidence identified connecting the documented Co-op technology relationships to Israeli military or settlement activity during either period.

Settlement nexus

No public evidence identified of digital technology sold, licensed, hosted or operated by Co-op in Israeli settlements in the occupied Palestinian territories.

No public evidence identified of a Co-op-controlled technology platform specifically servicing Israeli settlements.

AI, Algorithmic & Autonomous Systems

Retail and commercial AI

Co-op disclosed a retail security AI trial involving 14 stores in the first half of 2024. The system detected theft-related activity and physical assaults and generated operational alerts.⁷

The historical Microsoft Azure/SAP case study describes analytics used to identify purchasing patterns and optimise product allocation by store and location.²

Co-op’s privacy notice describes AI-assisted personalisation of membership offers based on shopping behaviour and the use of automated decision-making for certain customer and insurance activities.¹²

These sources establish AI and analytics applications for commercial retail operations, customer services and store security.^{2, 7, 12}

Israeli state AI provision

No public evidence identified of Co-op providing AI, machine learning, computer vision or autonomous decision-support technology to Israeli state institutions.

Training data and model development

No public evidence identified of Co-op training AI models on Palestinian civilian surveillance data, intercepted communications or datasets obtained from Israeli security institutions.

No public evidence identified of Co-op supplying datasets to an Israeli military AI programme.

Autonomous systems

No public evidence identified of Co-op supplying autonomous tracking, threat-detection or targeting systems to Israeli military or security organisations.

No public evidence identified of Co-op developing purpose-built kinetic targeting or weapons-effect AI systems; such systems would fall within the separate Military domain if subsequently established.

Technology Ecosystem & R&D Footprint

Corporate technology development

Co-op’s February 2026 checkout programme included software reportedly developed by its own technology teams, deployed alongside Diebold Nixdorf retail equipment.⁵

The documented TCS relationship includes technology transformation covering retail, infrastructure, core systems and franchise operations, with the February 2024 announcement describing an extension of longstanding commercial cooperation.¹

No public evidence identified of Co-op maintaining an Israeli research laboratory, engineering centre or technology accelerator.

Acquisitions and strategic investments

No public evidence identified of Co-op acquiring an Israeli-origin cybersecurity, surveillance, AI or defence technology company.

No public evidence identified of Co-op investing directly in an Israeli technology startup or Israeli venture capital fund.

Patents and intellectual property

No public evidence identified of patent co-development, licensing or material intellectual-property arrangements between Co-op and an Israeli-domiciled technology company or research university.

Corporate governance

A February 2025 corporate announcement identified Wais Shaifta and Lord Simon Woolley as new independent non-executive directors. The announcement described Shaifta’s technology-sector leadership experience, including previous roles at Push Doctor, Just Eat and Treatwell.¹⁴

In March 2026, Co-op announced that Shirine Khoury-Haq would step down as Group CEO and that Kate Allum would become Interim Group CEO from 30 March 2026.¹⁵

On 10 August 2026, Co-op announced Debbie White’s departure as Group Chair and the appointment of Moni Mannings OBE as Interim Chair.¹⁶

No public evidence identified linking these named directors or executives, through their disclosed Co-op roles, to investments or board positions in Israeli surveillance, SIGINT, military AI or defence technology firms.

No public evidence identified of a controlling corporate shareholder directing Co-op technology procurement towards Israeli security companies.

Group attribution

Co-op’s published privacy notice identifies Food, Insurance, Legal Services and Funeralcare among its group businesses. It describes sharing of personal information among group entities where relevant to their operations.¹²

Reporting following the 2025 cyberattack distinguished The Co-operative Group from other independently operated retail co-operative societies, including in relation to membership information affected by the incident.¹⁷

No public evidence identified of a technology relationship involving an independently operated co-operative society that can be attributed to The Co-operative Group solely through shared branding or retail cooperation.

On 16 July 2025, The Co-operative Group announced a strategic cybersecurity partnership with The Hacking Games, a UK-based social impact organisation specialising in identifying young digital talent and directing it towards ethical cybersecurity careers. The initiative formed part of Co-op’s response to its April 2025 cyberattack. Its initial activities included independent research led by Professor Jonathan Lusthaus of the University of Oxford into the social dimensions of cybercrime, intended to inform prevention strategies. Co-op also announced plans for a pilot programme within Co-op Academies Trust, which supported approximately 20,000 students across 38 schools, with ambitions for targeted student and parent training, earlier intervention and pathways into ethical hacking careers. The programme was described as a long-term collaboration addressing cybercrime prevention through research, education and skills development.¹⁸

On 19 November 2025, Co-op and The Hacking Games held their first cybersecurity Inspire Session at Co-op Academy Walkden in Salford, attended by approximately 300 students aged 13–14. Speakers included Mivy James, Chief Digital and Technology Officer at the UK Ministry of Defence; Greg Francis, cybersecurity offender-prevention consultant at 4D Cyber Security and former SOCA/NCA cybercrime investigator; and Chris Kubecka, an international cyberwarfare expert. The event introduced students to ethical hacking and cybersecurity career opportunities. Co-op Chief Digital and Information Officer Rob Elsey publicly supported the initiative, while the organisers identified mentoring, apprenticeships and further school events as planned subsequent activities. The documented Ministry of Defence connection consisted of participation by a senior UK defence technology official as an educational speaker; the reviewed sources did not establish a defence procurement contract, military technology transfer or operational cybersecurity partnership between Co-op and the Ministry of Defence.^{19, 20}

Civil Society Scrutiny & Regulatory History

UN and specialist NGO investigations

No public evidence identified in the accessible research record establishing that The Co-operative Group is specifically named as a technology supplier to Israeli settlements in the UN OHCHR settlement-business database.

No public evidence identified of a target-specific technology finding concerning The Co-operative Group in UN report A/HRC/59/23.

No public evidence identified of a target-specific Israeli military technology investigation published by Who Profits, AFSC Investigate, Amnesty International, Human Rights Watch or the other specialist organisations searched.

These evidence gaps do not establish that every entry in the relevant institutional databases has been independently verified.

Boycott and divestment activity

No public evidence identified of a boycott campaign specifically targeting Co-op for supplying Israeli surveillance, cybersecurity, cloud or military AI technology.

No public evidence identified of a divestment campaign against Co-op based on a verified Israeli digital technology contract.

Cybersecurity incident and regulatory context

On 30 April 2025, The Guardian reported that Co-op had restricted access to parts of its IT infrastructure following attempted unauthorised access. The disruption affected back-office and call-centre operations, with potential consequences for retail stock management.²¹

Co-operative News subsequently reported operational disruption, stock shortages and unauthorised access to membership information. The reporting described Co-op’s cooperation with the National Cyber Security Centre and National Crime Agency.¹⁷

In September 2025, Co-op reported an estimated £80 million first-half financial impact from the cyberattack, while independent reporting described operational disruption and compromised membership information.²²

In its March 2026 trading update, Co-op reported an estimated full-year 2025 cyberattack impact of £285 million on revenue and £107 million on profitability. The group also reported £318 million of capital investment during 2025, including expenditure on technology and stores.²³

The cyberattack evidence establishes material disruption to Co-op’s UK operations and information systems. The cited disclosures do not attribute the attack to Israeli state actors or establish an Israeli technology supply relationship.^{17, 21, 22, 23}

Technology-related legal and regulatory actions involving Israel

No public evidence identified of an export-control investigation involving Co-op technology supplied to Israel.

No public evidence identified of sanctions proceedings involving Co-op digital services supplied to Israeli military or settlement entities.

No public evidence identified of an OECD National Contact Point complaint concerning Co-op’s technology provision to Israeli institutions.

No public evidence identified of regulatory findings that Co-op transferred biometric, membership or surveillance information into Israeli jurisdiction.

On 16 July 2025, The Co-operative Group CEO Shirine Khoury-Haq confirmed that personal information belonging to all 6.5 million Co-op members had been stolen during the April 2025 cyberattack. The compromised information included members’ names, addresses and contact details. Khoury-Haq apologised publicly and stated that financial information, including credit and debit card numbers and transaction data, had not been stolen. This disclosure established the full reported scale of membership data exposure, whereas earlier company statements had referred only to a significant number of affected customers. The Guardian also reported that Co-op had invested in cyberattack detection systems rather than cyber-insurance policies and did not expect significant insurance recovery of its losses.²⁴