Tesco Bank falls to UK’s first cyber heist; funds withdrawn from 20,000 current accounts

Reuters: Tesco Bank, owned by Britain’s biggest retailer Tesco, halted online transactions from all current accounts on Monday after money was stolen from 20,000 of them in the country’s first such cyber heist.

The bank, which manages 136,000 current accounts, said it would repay people who had lost money in the attack, which targeted 40,000 accounts in all and fuelled fears about the British financial sector’s vulnerability.

Tesco Bank’s Chief Executive Benny Higgins told the BBC he thought “relatively small amounts” had been stolen, but the bank declined to give details of how much money in total had been taken or if it knew how the thefts had transpired.

Other British banks have been targeted by hackers in recent years, but the Financial Conduct Authority (FCA) regulator said it was not aware of any previous incident in which customers had had money stolen.

Tesco Bank said “online criminal activity” had resulted in money being “withdrawn fraudulently”. Higgins said the cost of refunding people under its regulatory obligations would be “a big number but not a huge number”.

In an updated statement late on Monday, the bank said it had begun refunding all affected customer accounts and expected to complete the process by the end of Tuesday.

Banks and cyber security experts in the United States said they were eager for more information. “This is something we want to follow very closely,” American Bankers Association Senior Vice President Doug Johnson, said.

“We want to learn exactly what happened here and take lessons learned so these attacks don’t cascade from one institution to another.”

British lawmaker Andrew Tyrie, Chair of Parliament’s powerful finance committee, criticised both banks and regulators for doing too little to improve cyber security after a string of technical failures and breaches of banking systems.

“We can’t go on like this,” he said in a statement, pledging to take up the issue with both Tesco Bank and regulators.

“Millions of customers remain unnecessarily exposed to the risk of IT failures, including delays in paying bills and an inability to access their own money,” he said.

Tesco Bank’s website carried a statement from Higgins apologising to customers all day on Monday. The bank has about 8 million customers in total, including many who use its credit cards or insurance products but not its current accounts.