Big Hack At Tesco Bank – Money Vanished

Tesco Bank has halted online payments for current account customers after ‘over £10m’ was taken from 20,000 accounts.

The bank's chief executive Benny Higgins said he was "very hopeful" customers would be refunded within 24 hours. About 40,000 accounts saw suspicious transactions over the weekend, of which half had money taken, he said.

Customers will still be able to use their cards for cash withdrawals, chip and pin payments, and bill payments.

They can also use online banking, but cannot make online transactions until the situation is back under control, Mr Higgins told the BBC's Today programme. And an employee told CSI that over £10 m was thought to have been taken.

Earlier, the bank confirmed some accounts "have been subject to online criminal activity, in some cases resulting in money being withdrawn fraudulently". Mr Higgins also apologised for the "worry and inconvenience" that customers have faced.

One cybersecurity expert said this could be an unprecedented breach at a British bank. "I've not heard of an attack of this nature and scale on a UK bank where it appears that the bank's central system is the target," said Prof Alan Woodward, a security consultant who has worked with Europol.

Recently, customers complained about money being withdrawn without permission, cards being blocked and long delays to get through to the bank on the phone.

"Any financial loss that results from this fraudulent activity will be borne by the bank," Mr Higgins said. "Customers are not at financial risk."

Tesco has yet to use the word "hacking" to describe the breach. The bank has more than seven million customer accounts and 4,000 staff, based in Edinburgh, Glasgow and Newcastle.

Kevin Smith, from Blackpool, said he had lost £500 from one account and £20 from another. He said: "I was just about to go to bed when I received a text message from Tesco saying there had been fraud on my account. So of course you panic."

Alan Baxter, from Berwick-upon-Tweed, said he had lost £600, leaving him with just £21.88 in the bank. He said: "Tesco said they couldn't offer me emergency funds but would offer £25 as a goodwill gesture.

"I've got food and petrol to pay for. I have a delivery of coal coming tomorrow for our coal-fired heater and I won't be able to pay."

'Money has vanished'

Other customers complained on Tesco Bank's website and through social media about long delays when calling the company's customer service line to find out if their account was affected.

Mark Noakes, from Thrapston, told the BBC: "Looked at my account this morning to find a large hole! There was £2 in there; there should have been a lot more! "Finally got through to customer services to be told it would take 48 hours to sort as there had been a lot of transactions on my account that could not be linked to me or my wife.

"For such a big company they are not being professional. I'm doing well compared to some others as I have another bank account and this will all get sorted somehow."

Make no mistake, while Tesco Bank is stressing that relatively small amounts were taken from 20,000 accounts, this is a very serious security incident. All Tesco Bank will say is that it has been the victim of "online criminal activity" so we have little detail on the nature of the attack.

But what is different is that it involves tens of thousands falling victim in a 24-hour period to what appears to be an automated process, rather than individuals clicking on links in phishing emails or having their details stolen after downloading malicious software.

That could involve the attackers exploiting a vulnerability in the bank's website - or even gaining physical access to a branch and then the central systems. Whatever has happened, the damage to trust in Tesco Bank and online banking in general will be greater than the financial cost.

Action and arrests

A National Crime Agency (NCA) spokesman confirmed it leading the investigation into the case, but stressed there was "no set formula" for dealing with cyber-attacks, which tend to vary in terms of sophistication. "It will be investigated and hopefully that will lead to action and arrests," he said.

The UK's data regulator, the Information Commissioner's Office, also said it was looking into the case and could investigate if customers' personal data has not been kept secure.

Tesco Bank said: "We continue to work with the authorities and regulators to address the fraud and will keep our customers informed through regular updates on our website, Twitter, and direct communication."

Refund rules

UK bank customers have had money stolen from their online accounts by criminals before. Last year, the NCA warned internet users to protect themselves against a strain of malicious software, which had enabled criminals to steal an estimated £20m from UK bank accounts.

The Financial Conduct Authority says banks must refund unauthorised payments immediately, unless they have evidence that the customer was at fault or the payment was more than 13 months ago. Banks are also required to refund any charges or interest added to your account as a result of the fraudulent payments.

Tesco Bank has been owned by Tesco plc since 2008, after starting as a joint venture with Royal Bank of Scotland. Shares in Tesco fell 1% in morning trading.

BBC:                           Hackers Target All The Major UK Banks:
 

« Is The CIA Ready For Post-Election Chaos?
International Police Start Crackdown On The Darknet »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Our Supplier Directory lists 6,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

JumpCloud

JumpCloud

JumpCloud's Directory-as-a-Service (DaaS) is the single point of authority to authenticate, authorize, and manage the identities of a business’s employees and the systems and IT resources they need.

Snyk

Snyk

Snyk is the leader in developer security. We empower the world’s developers to build secure applications and equip security teams to meet the demands of the digital world.

Suprema

Suprema

Suprema is a leading global provider of access control and biometrics solutions.

Asoftnet

Asoftnet

Asoftnet are specialists in IT security, IT forensics, IT service, websites, applications and mobile solutions.

VerSprite

VerSprite

VerSprite is a specialist information security consulting firm. We provide organizations with detection across all their attack surfaces and deliver critical insight into all possible attack methods.

Philippine National Police Anti-Cybercrime Group (PNP-ACG)

Philippine National Police Anti-Cybercrime Group (PNP-ACG)

The mission of the PNP Anti-Cybercrime Group is to implement and enforce pertinent laws on cybercrime and other cyber related crimes and pursue an effective anti-cybercrime campaign.

Calero Software

Calero Software

Calero is a leading global provider of Communications and Cloud Lifecycle Management (CLM) solutions designed to simplify the management of voice, mobile and other unified communications services.

Shieldfy

Shieldfy

Shieldfy is a cloud-based security shield for your website to protect it from cyber attacks and malwares.

Brighter AI

Brighter AI

Brighter AI empowers companies to use publicly-recorded camera data for analytics & AI while being compliant with increasing data privacy regulations worldwide.

Cyber Range Malaysia

Cyber Range Malaysia

With Cyber Range Malaysia organizations can train their security professionals in empirically valid cyber war-gaming scenarios necessary to develop IT staff skills and instincts for defensive action.

Cypress Data Defense

Cypress Data Defense

Cypress Data Defense helps clients build secure applications by providing training, best practices, and evaluating security during every stage of the Secure Application Development Lifecycle.

HighPoint

HighPoint

HighPoint is a leading technology infrastructure solutions provider offering consultancy, solutions and managed services for network infrastructure and cybersecurity.

Berezha Security Group (BSG)

Berezha Security Group (BSG)

BSG is a cybersecurity consulting firm specializing in all aspects of application security and penetration testing.

DAtAnchor

DAtAnchor

Anchor is simply a better way to protect and control sensitive data. Zero-trust, data-centric security. Simplified.

Custom Computer Specialist (CCS)

Custom Computer Specialist (CCS)

CCS offers an extensive range of services including cybersecurity solutions, consulting, implementation, and support to help our clients maximize the value derived from IT investments.

Oxygen Technologies

Oxygen Technologies

Oxygen Technologies is a business systems strategy and integration company offering a variety of solutions to give our clients ways to work smarter not harder.