More than a quarter of a million customers of payday loan firm Wonga are being warned that their personal data may have been stolen in a data breach at the firm.

The online lender said it was “urgently investigating illegal and unauthorised access” to the personal data of some of its customers in the UK and Poland. It is understood that the breach could affect up to 270,000 current and former customers, including 245,000 in the UK. The company would not disclose where it had taken place.

The lender, which offers loans at interest rates starting at 1,286% a year, became aware of a problem last week but did not realise until Friday that data could be accessed externally. It alerted the authorities and started to contact borrowers on Saturday to make them aware of the problem, and give details of a dedicated customer services phone line for those affected.

Customers who are thought to have been affected have received a message from the payday lender telling them: “We believe there may have been illegal and unauthorised access to some of your personal data on your Wonga.com account.”

The message said that Wonga was working to establish the full details but data breached “may have included one or more of the following: name, email address, home address, phone number, the last four digits of your card number (but not the whole number) and/or your bank account number and sort code.”

It went on to say that the lender believed Wonga accounts and passwords had not been compromised, but customers were advised to look out for unusual activity across their accounts. In a statement the firm said: “We are working closely with authorities and we are in the process of informing affected customers. We sincerely apologise for the inconvenience caused.”

The breach will be a blow to Wonga, which has in recent years attempted to improve its reputation following a series of controversies. The lender, which advertised heavily on TV and through football sponsorships, was found by the financial regulator to have made loans to customers who could not afford to repay them and to have chased bad debts with letters from a fake law firm. New directors have replaced the firm’s original founders, a three-month loan launched alongside the short-term payday loan, and marketing has been changed to appeal to a better-off audience.



However, it has been hard hit by tougher rules on lending, introduced when the Financial Conduct Authority (FCA) took on stewardship of the sector. The latest set of results showed that the firm made a pre-tax loss of £80.2m in 2015, up from £38.1m the year before.

There was no sign of the breach on the lender’s website, which carried its usual information on how to apply for its loans. It has alerted the police, the Information Commissioner’s Office (ICO) and the FCA. The ICO regulates firms’ use and care of people’s personal details, although financial services companies are not obliged to inform it of any breach. A spokesperson for the organisatio said: “All organisations have a responsibility to keep customers’ personal information secure. Where we find this has not happened, we can investigate and may take enforcement action.”

Wonga is the latest in a long line of companies to discover that information they hold on their customers has been compromised. In November, Tesco Bank suspended online transactions after £2.5m was stolen from 9,000 customers, while mobile phone operator Three said information from 130,000 users had been compromised when its systems were breached. A cyber attack on phone company Talk Talk in 2015 resulted in a £400,000 fine from the ICO after it found the firm “could have been prevented if TalkTalk had taken basic steps to protect customers’ information”.

On Twitter, some of Wonga’s customers were expressing concern about the breach and complaining that they were struggling to get onto Wonga’s website to change their account passwords. One tweeted the @OfficialWonga feed to say: “Received an email that my details may have been hacked. Please can you tell me if this is real? Been on hold for ages.”

