Anatomy of a Breach

Anatomy of a Breach: Tesco Bank — £2.5 Million Stolen from 9,000 Customer Accounts in a Weekend Attack

> series: anatomy_of_a_breach —— part: 095 —— target: tesco_bank —— stolen: £2,500,000 —— accounts: 9,000 —— fca_fine: £16,400,000<span class="cursor-blink">_</span>_

Hedgehog Security 30 November 2016 13 min read

9,000 accounts drained. £2.5 million stolen. Online banking suspended for 136,000 customers.

On the weekend of 5-6 November 2016, Tesco Bank detected a wave of suspicious transactions affecting its current account customers. Approximately 9,000 accounts were targeted, with around £2.5 million successfully stolen through fraudulent debit card transactions. Tesco Bank took the unprecedented step of suspending all online card transactions for its 136,000 current account holders — the first time a UK bank had been forced to halt online transactions due to a cyber attack.

The FCA's investigation revealed that attackers had exploited weaknesses in Tesco Bank's design of its debit card system, including the algorithm used to generate card numbers and the authentication controls on card transactions. The FCA fined Tesco Bank £16.4 million — finding that the bank had failed to exercise due skill, care, and diligence in protecting its personal current account holders from a 'largely avoidable' attack. Tesco Bank refunded all affected customers in full.


Recommended

Not sure where to start?

We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.

Free Scoping Call

The first mass fraud against UK current accounts.

Previous major payment fraud events in the UK — and internationally — had targeted payment processors, retailers, and credit card systems. The Tesco Bank attack was different: it targeted current account debit cards directly, draining money from customers' bank accounts rather than compromising cards at the point of sale. For UK consumers, the attack struck at the heart of banking trust — the expectation that money in a current account is safe.

Card System Design Weaknesses
The FCA found that Tesco Bank's debit card system had design weaknesses — including how card numbers were generated and how transactions were authenticated. These are the types of systemic design flaws that our <a href="/penetration-testing/pci-dss">PCI DSS penetration testing</a> and <a href="/penetration-testing/web-application">application testing</a> are designed to identify before attackers exploit them.
£16.4 Million FCA Fine
The FCA's £16.4 million fine — for a 'largely avoidable' attack — sent a clear message to UK financial services: regulators will impose significant penalties for security failures that harm customers. Combined with the <a href="/blog/anatomy-of-a-breach-zurich-insurance-uk">Zurich Insurance FSA fine</a> (2010), UK financial regulators have consistently demonstrated willingness to punish data security failures. Our <a href="/blog/sector-under-the-microscope-financial-services">financial services analysis</a> examines the regulatory landscape.
Online Banking Suspended
Tesco Bank's decision to halt all online card transactions for 136,000 customers was commercially devastating but operationally necessary. The ability to detect, contain, and respond to an active attack — including the decision to temporarily suspend services — requires tested incident response plans. <a href="https://www.cyber-defence.io/services/incident-response">UK Cyber Defence</a> provides incident response planning and execution.
Weekend Timing — Again
The attack occurred over a weekend — the same timing pattern seen in the <a href="/blog/anatomy-of-a-breach-saudi-aramco-shamoon">Saudi Aramco Shamoon attack</a> (2012) and the <a href="/blog/anatomy-of-a-breach-bangladesh-bank-swift">Bangladesh Bank heist</a> (2016). <a href="https://www.socinabox.co.uk/sectors/ifas-wealth-managers">SOC in a Box for Financial Services</a> provides 24/7/365 monitoring that covers weekends and bank holidays.

The FCA expects due skill, care, and diligence. Can you demonstrate it?

The Tesco Bank fine established that the FCA considers cyber security failures to be failures of 'due skill, care and diligence' — the same standard applied to other operational failures. For FCA-regulated firms, this means that cyber security is not an IT issue but a regulatory compliance obligation that the board must own.

Our PCI DSS penetration testing assesses payment card system security. Infrastructure testing validates fraud detection and transaction monitoring controls. Cyber Essentials certification provides evidence of baseline security. SOC in a Box for Financial Services provides the continuous monitoring the FCA expects. And UK Cyber Defence provides the incident response capability that turns an attack into a managed event rather than a £16.4 million fine.


The FCA fined Tesco Bank £16.4 million for a 'largely avoidable' attack. Is yours avoidable?

Our <a href="/penetration-testing/pci-dss">PCI DSS testing</a> assesses payment system security. <a href="/cyber-essentials">Cyber Essentials</a> certifies baseline controls. <a href="https://www.socinabox.co.uk/sectors/ifas-wealth-managers">SOC in a Box</a> monitors 24/7.

Next Step

Not sure where to start?

We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.

Free Scoping Call

Related Articles