Tesco bank hack in U.K. sees 20,000 customers lose money

The banking arm of Britain's biggest retailer Tesco was scrambling on Monday to deal with an online attack over the weekend on 40,000 customers' accounts, 20,000 of which had money removed.

The hack is the first on a British bank known to have resulted in customers losing money, adding to growing concerns about the British financial sector's vulnerabilities to cyberattacks, which have jumped in frequency over the past two years.

Tesco Bank, which manages 136,000 current accounts, stopped all online transactions while it worked to resume normal service, although customers could still use their bank cards in shops and to withdraw money from cash machines.

• SWIFT says hackers infiltrated a commercial bank
• Iranian hackers charged in cyberattack on U.S. banks

"Any financial loss that results from this fraudulent activity will be borne by the bank," Tesco Bank Chief Executive Benny Higgins told BBC radio. "Customers are not at financial risk. 

"We think it would be relatively small amounts that have come out but we're still working on that," he said, adding that he expected the cost of refunding customers would be "a big number but not a huge number."

Shares drop 

Shares in supermarket chain Tesco, which wholly owns Tesco Bank, were down 1.2 per cent at 200.20 pence by 10:30  a.m. The bank is a minnow in Britain's retail banking market, with about two per cent of current accounts, and represents only a small part of Tesco's overall business.

It contributed 503 million pounds ($837 million Cdn) to the group's revenue of 24.4 billion pounds in the first half of its 2016-17 financial year.

But while the financial hit to the group may be limited, Tesco Bank risks serious reputational damage from an attack that affected 29 per cent of its customer current accounts.

Other British banks have been targeted by cyberattacks in recent years, but the Financial Conduct Authority (FCA) which regulates the sector said it was not aware of any previous incident in which customers had lost money.

Understaffing to blame?

Reported attacks on financial institutions in Britain have risen from just five in 2014 to over 75 so far this year, according to FCA data, but bank executives and providers of security systems say there are many more unreported attacks.

HSBC issued a series of apologies to customers earlier this year after its U.K. personal banking websites were shut down by a "denial of service" attack, but no customer funds were at threat during that breach.

• $100M bank heist linked to hacks on Sony Pictures
• How a hacker's typo helped stop a billion dollar bank heist

Cliff Moyce, global head of financial services at DataArt, a network of technology consulting and software services firms, said reduced staffing levels over the weekend were likely to have been one of the reasons for the impact of the hack.

"The clever part was doing it over the weekend when banks are typically understaffed, and will respond more slowly," he said in a comment emailed to media.

"Automated fraud detection systems appear to have worked well, but a lack of people at desks will not have helped."