Up to 40,000 customers were affected, with half having money taken out. Photograph: Andrew Milligan/PA

Tesco Bank was scrambling to restore services for customers on Monday after it admitted 40,000 customers had been affected by an online heist over the weekend when money was stolen from half the number of accounts targeted.

Tesco immediately froze online transactions and pledged to refund the 20,000 customers whose current accounts had been plundered in one of the largest cyber-thefts ever to hit a UK bank.

Benny Higgins, chief executive of the supermarket chain’s banking arm, said the decision to suspend some banking activities was an attempt to protect customers from “online criminal activity”. The National Crime Agency (NCA) is one of a number of organisations scrutinising what has taken place at a bank with more than 7 million customers.

“We apologise for the worry and inconvenience that this has caused for customers, and can only stress that we are taking every step to protect our customers’ accounts,” said Higgins.

Refunds to customers – some of whom claimed they had lost thousands of pounds – were under way on Monday but Higgins was facing demands from MPs for an explanation of what had gone wrong in the face of repeated warnings about cybersecurity from regulators in recent years.



It is thought to be the first time such a large group of UK bank customers have lost money as a result of a single cyber-crime incident and could prove costly for its parent supermarket group in reputational as well as financial terms.

There were also concerns of collateral brand damage for other digital and online banks attempting to compete with established high street players, as Tesco raced to keep pace with the deluge of complaints on social media about difficulty reaching its call centres in Glasgow and Newcastle.

Higgins provided little explanation for what had gone wrong over the weekend, when the bank started to text customers to warn them it had detected suspicious activity.

However, he told the BBC it was “a systematic, sophisticated attack”.

The chief executive, who earlier this year faced questions about a £18,000 expenses bill he had submitted to his employer, said the decision to “temporarily stop online transactions from current accounts” was a temporary measure. Late on Monday, the bank admitted the suspension was still in place and it was “working hard to resume normal service on current accounts as soon as possible”.

Despite its more than 7 million customers who use services ranging from credit cards to small loans, Tesco Bank has just 137,000 current accounts. It has has been fighting to win current account business in a market that is traditionally dominated by the “big four” of Lloyds Banking Group, HSBC, Royal Bank of Scotland and Barclays. While customers can pay in cheques and cash at 300 Tesco stores, most of the business is conducted through an app and the internet. It has been trying to win customers by offering 3% interest on balances of up to £3,000 – and letting customers have two accounts – at a time when others are cutting their rates.

Tashema Jackson, money expert at price comparision website uSwitch.com, said: “As well as being a blow for Tesco Bank, there could also be knock-on effects for other challenger banks wanting to take market share from the high street banks. A security failure of this nature could mean challengers, who already face an uphill battle convincing customers to switch, may find concerns around security will further put people off making that step away from their current bank.”

Some of its customers appear to have used the current account purely as a savings account. One customer affected by the cyber raid, Mark Taylor, said he had never used his debit card because he uses the account purely as a home for his savings.

Taylor had £3,000 in the account and, after receiving a text message from Tesco at the weekend, he logged on and was shocked to see that his available balance had dropped to £574.73 after more than £2,400 was apparently siphoned from it.

“I spent the next hour and 20 minutes on hold waiting to talk to Tesco. They blocked my account – worryingly it wasn’t blocked already and the last £574 could have been taken. I’m now waiting for a phone call back from their fraud team.”



Taylor, who lives in Leeds, said it later transpired that the money had been withdrawn in four separate transactions. The four amounts were for £9.33, £802.61, £795.27 and £818.26, “all to different retailers in Spain”.



The incident has sparked a wave of theories about how it was orchestrated. Taylor, who works as a security engineer, speculated that it was an internal security breach. Others suggested that hackers had been involved.

Conservative MP Chris Philp, a member of the Treasury select committee, said it could have been the work of a foreign power.

“I think we can’t rule out the possibility, at all, that this is state-sponsored,” he told the BBC.

It comes after the Bank of England has issued a series of warnings about cybersecurity threats to the financial sector. But it is not the only industry which has been hit. Telecoms company TalkTalk was hit with a record £400,000 fine from the Information Commissioner’s Office in October for failing to stop personal data of 157,000 customers being obtained.

The ICO is one of a number of authorities scrutinising Tesco Bank. City watchdog the Financial Conduct Authority is monitoring the situation and keeping the Bank of England informed. The NCA said it had been notified by Tesco Bank and was coordinating a response among law enforcement agencies. ICO said: “We’re aware of this incident and are looking into the details. The law requires organisations to have appropriate measures in place to keep people’s personal data secure. Where there’s a suggestion that hasn’t happened, the ICO can investigate, and enforce if necessary.”

Andrew Tyrie, the MP who chairs the Treasury select committee, said it was the latest in a long list of IT failures and security breaches in the financial sector. He added that he would writing to Higgins for an explanation and reassurance it will not happen again. “Making sure that banks improve their IT systems, and their resilience to cybercrime, is also a responsibility of regulators. We will raise this issue with them again shortly. We can’t carry on like this,” he said.

Shares in Tesco, one of Britain’s biggest listed businesses, were among the biggest fallers on the stock market. Pete Hahn, of the London Institute of Banking & Finance, said: “The question is does the reputation that the bank has suffered translate to [Tesco’s] other businesses.”