Co-op narrowly escaped a complete IT shutdown during its recent cyber attack, say computer hackers.

According to communications seen by the BBC, the alleged perpetrators of the attack claim the outcome of the incident could have been far worse.

The attackers claim they had breached Co-op’s systems and planned to deploy malicious software, designed to lock a company out of its own core systems until a ransom is paid.

But the hackers say that plot was disrupted mid-attack when Co-op’s internal systems detected a breach and swiftly shut down parts of its network.

It is understood that this pre-emptive shutdown is what caused disruptions, due to Co-op voluntarily halting its own systems. This resulted in short-term issues, such as shortages, supply delays and further logistical issues, but may have avoided more serious long-term implications.

Subscribe to Grocery Gazette for free

Sign up here to get the latest grocery and food news each morning

Although both Co-op and M&S, which also suffered a cyber attack, have declined to comment on specifics, analysts believe the difference in outcomes may lie in the speed and decisiveness of internal responses.

Speaking to the BBC, Ransomware Task Force cyber expert Jen Ellis said: “Co-op seems to have opted for self-imposed immediate-term disruption as a means of avoiding criminal-imposed, longer-term disruption. It seems to have been a good call for them in this instance.”

Yesterday, Co-op revealed it is now in “recovery”, and is “Taking steps to bring our systems gradually back online in a safe and controlled manner.”

The retailer said that there will be improved stock availability in stores and online from this weekend. It added that its stock ordering system is now fully online, with all orders switched back to normal supply processes and systems.

All forms of payments, including contactless and chip and pin are working across the Co-op store estate.

The spokesperson added: “We’d like to thank all our colleagues, members, partners and suppliers for their support so far. We will provide further updates to our members as we continue to make progress from this cyber attack.”