Tesco Could Have Been Facing £2bn Fine After The Bank Hack

Tesco Bank may have refunded £2.5m to its current account customers following the recent attack but its parent company could have been facing a fine of nearly £2bn if the breach had happened under the EU General Data Protection Regulation (GDPR), coming into force in May 2018.

Tesco Bank had a turnover of £955m in the year to the end of September 2016, according to Tesco's latest accounts, but the parent firm filed a turnover of £48.4bn.

Under the GDPR, that could subject the company to a fine of up to 4% of worldwide group turnover, equaling £1.94bn, with possible class-action lawsuits on top.

On the 11th November the bank confirmed normal service had resumed following the temporary suspension of online transactions from current accounts.

It also insisted that personal data was not compromised as a result of fraud that took place over the weekend of November 5-6 and that online transactions had been suspended to prevent criminal activity.

Tesco Bank chief executive Benny Higgins commented: “Our first priority throughout this incident has been protecting and looking after our customers and we’d again like to apologise for the worry and inconvenience this issue has caused.

“We’ve now refunded all customer accounts affected by fraud and lifted the suspension of online debit transactions so that customers can use their accounts as normal. We’d also like to reassure our customers that none of their personal data has been compromised.”

After Tesco’s are more Banks Cyber Vulnerable?

Consumers worried about falling victim to online banking fraud should consider banks that give customers card readers and avoid those which rely on text messages, according to leading security expert Graham Cluley.

He was speaking as Tesco Bank continued to deal with the fallout from the “systematic, sophisticated attack” that resulted in £2.5m being taken from around 9,000 current account holders.

Meanwhile, another expert says that the Tesco attack could be the first of many, and banks should be forced by regulators to up their game.

Experts have suggested that the cyber-attack on Tesco Bank could be an inside job. Cyber criminals managed to steal money from more than 20,000 accounts at nearly the same time in automated fashion.

The bank was forced to suspend online banking for all its 136,000 customers after money, in some cases several thousand pounds, was stolen from accounts. It is thought much of it ended up in Spain and Brazil.

Although the number of customers affected was later downgraded from the original 20,000, Tesco has declined to reveal how the money was taken. It did say that personal data had not been compromised, leading some experts to suggest that the fraudsters had gained debit card details, or found a vulnerability in its app.

The National Crime Agency is investigating, but questions are already being asked about levels of security.

It has emerged that Tesco Bank used to issue customers with card readers, small devices that generate a unique passcode when you insert your card and key in your pin. These typically authorise your login and certain transactions. But the bank later moved to mobile phone verification, where it sends a code to your handset.

Cliff Moyce, global head of financial services at technology firm DataArt, told Guardian Money that the financial regulators need to take a stronger line if further incidents are to be prevented.

Moyce, who has worked in financial security for more than 25 years, says Tesco Bank customer losses were “almost certainly” not the result of a TalkTalk-style outside hack, but were more likely caused by a failure of its IT security and data protection processes.

“No bank can ever claim to be 100% secure and attacks by fraudsters are a fact of life. The problem is that the banks need to do a lot better, the regulators need to be forcing them to adopt the best practice… unless this happens it will only be a matter of time before there is another similar episode at another bank,” he says.

One line of investigation is likely to focus on the possibility of an “economic hack”, says Moyce, whereby an offshore employee is offered multiples of their annual salary in return for a tranche of customer data. One thing that might raise eyebrows is that the bank’s staff were seemingly encouraged to use their own smartphones and tablets for work, a trend commonly known as “bring your own device”, or BYOD.

In a 2015 interview Tesco Bank’s then chief information officer, Chris Brocklesby, revealed how he had “championed” BYOD, adding: “A trial has been successful and we will fully roll out in 2015. The initial release will be for phones and tablets.”

Moyce, who admits he has no idea if this was taken up at Tesco Bank, says such a move would be controversial. “BYOD always brings risks, especially in the areas of breaches of the UK Data Protection Act, as it is too easy for confidential and sensitive information to end up in a personal device that may be lost, sold or taken to another employment. There is also a risk of introducing malware into a secure network.”

He suggested good BYOD policies, implemented rigorously, can reduce the risks to the same level as any company-supplied devices. The question is whether your bank is operating good policies and practices.

Professor Alan Woodward, banking security expert at the University of Surrey, says he was surprised Tesco has been so coy about what actually happened. “The fact they have said that customers’ personal data was not compromised suggests that the hackers may have harvested customers’ debit card details and then used them in an automated mass attack. They really need to come out and give more details.”

In October 2016 the consumer group Which? criticised some of Britain’s biggest banks for failing to invest in security systems that would better protect their customers from fraudsters. It tested the UK’s 11 biggest banks and building societies and found that the security at five was not good enough.

Other Recent Bank Attacks

Two of Russia’s largest banks, Sberbank (SBER.MM) and Alfa Bank, say they have been hit by cyber-attacks in recent days.

Cybersecurity firm Kaspersky Lab said the distributed denial of service (DDoS) attacks represented the first major wave of such attacks on Russian banks this year and that at least five of the country’s largest banks had been targeted.

Russia has been on high alert for cyber threats after US Vice President Joe Biden said in October that Washington would retaliate against alleged Russian hackers “at the time of our choosing” following what the United States said was a campaign of cyber-attacks against Democratic Party organisations.

The source of this week’s attacks was unknown, however, and neither of the two Russian banks, nor Kaspersky, linked them to Biden’s comments.

Kaspersky said Russian banks were regularly subject to DDoS attacks, in which those conducting the attack flood the target with junk Internet traffic to disrupt its computer systems.

DataIQ:      Guardian:     InformatioSecurity:  AlJazirah:   

 

 

 

 

« Russia To Block LinkedIn
24 Cyber Criminals Arrested »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

DeviceLock

DeviceLock

DeviceLock is a leading provider of endpoint device/port control and data leak prevention software.

Qualitèsoft Technology

Qualitèsoft Technology

Qualitèsoft Technology is a leading Software Development and Quality Assurance organization. We specialize in Custom Development, Mobile Application, Software Testing and Quality Assurance.

Hack in the Box Security Conference (HitBSecConf)

Hack in the Box Security Conference (HitBSecConf)

HITBSecConf is a platform for the discussion and dissemination of next generation computer security issues. Our events feature two days of training and a two-day multi-track conference

WizNucleus

WizNucleus

WizNucleus develops, markets and supports a software platform (Cyberwiz-Pro) that enables Critical Infrastructure enterprises to ensure the future state of their cybersecurity and remain compliant.

Aspisec

Aspisec

Aspisec is a cybersecurity company specialized in Firmware Security and Critical Infrastructure Protection.

Shift5

Shift5

Shift5 focus on securing operational technology (OT) by building best-in-class, dual-use products serving military and commercial entities.

Bytes Technology Group

Bytes Technology Group

Bytes is a leading provider of world-class IT solutions. Our growing portfolio of services includes cloud, security, licensing, SAM, storage, virtualisation and managed services.

Cyberi

Cyberi

Cyberi provide specialist technical consultancy and cyber advisory services, from penetration testing and assurance to incident management and response, and technical security research.

RankedRight

RankedRight

RankedRight empowers security teams to take immediate action on their most critical risks.

Adversa AI

Adversa AI

Adversa's mission is to build trust in AI and protect AI from cyber threats, privacy issues, and safety incidents.

Protelion

Protelion

The Protelion Security Platform is uniquely architected to deliver security solutions that combine greater protection, flexibility, and performance.

inWebo

inWebo

inWebo is the specialist in multi-factor strong authentication (MFA). We guarantee the security of data and identities in a digital world with increasingly important economic and political stakes.

Lab 1

Lab 1

Lab 1 turns criminal data breaches and attacks into insights. Get alerts of data breaches or ransomware attack incidents as they happen.

Willyama Services

Willyama Services

Willyama Services is a certified Information Technology and Cybersecurity professional services business providing services to government and private sector clients.

Queen Consulting & Technologies

Queen Consulting & Technologies

Queen Consulting & Technologies specialize in providing IT support, management, and Security to Gov’t Contractors, CPAs, and Nonprofits.

Cyber Guards

Cyber Guards

Cyber Guards provide comprehensive, turn-key cyber security programs for small and mid-size business for about the cost of one full-time cybersecurity hire.