Thousands of National Lottery players have been exposed to a data breach allowing malefactors to potentially ransack customers' transaction history, date of birth, bank sort code, and the last four digits of their bank account number, its operator Camelot confirmed on Wednesday morning.

The company—which has 9.5 million players on its books—said that 26,500 accounts had been accessed, adding that 50 of them "had some activity take place."

Camelot, which spotted the suspicious activity on its systems on Monday, said that it doesn't "hold full debit card or bank account details in National Lottery players' online accounts and no money has been taken or deposited."

It added: "However, we do believe that this attack may have resulted in some of the personal information that the affected players hold in their online account being accessed."

Over on Twitter, at least one individual player was told by the National Lottery social media team: "we don’t believe bank accounts were accessed, you should notify your bank so they can monitor for any suspicious activity," while others have been warned "if you have a Direct Debit, your bank sort code and the last four digits of your bank account may have been accessed"—neither of which is explicitly mentioned in Camelot's official statement.

It said:

This was limited to some of their personal details being changed—and some of these details may have been changed by the players themselves. However, we have taken the measure of suspending the accounts of these players and are in the process of contacting them to help them re-activate their accounts securely. In addition, we have instigated a compulsory password reset on the accounts of the 26,500 affected players.

Camelot added: "We would like to make clear that there has been no unauthorised access to core National Lottery systems or any of our databases, which would affect National Lottery draws or payment of prizes."

The firm, which is working with the National Crime Agency and the National Cyber Security Centre, said it's still trying to get a handle on what happened, but suspects that "the e-mail address and password used on the National Lottery website may have been stolen from another website where affected players use the same details."

The Information Commissioner's Office told Ars: "We are aware of this incident and we have launched an investigation. Camelot submitted a breach report to us last night which we have reviewed. We will be talking to Camelot today.

"The Data Protection Act requires organisations to do all they can to keep personal data secure—that includes protecting it from cyber attacks. Where we find this has not happened, we can take action. Organisations should be reminded that cyber security is a matter for the boardroom, not just the IT department."