IT glitch exposed other customers' transaction data at Lloyds Banking Group

Up to 447,936 customers of Lloyds Bank, Halifax and Bank of Scotland saw other people's transactions or had their own data shared with other users during an IT glitch on 12 March, according to a letter from Lloyds Banking Group published by the Treasury Select Committee on 27 March¹.

The letter states that 114,182 people clicked on other people's transactions when they became visible and may then have been shown more detailed information such as account details, national insurance numbers and payment references¹. The cause of the incident has been identified as a software defect which occurred during an overnight update¹. The letter acknowledges that transaction information relating to individuals who are not Lloyds Banking Group customers may also have been visible¹.

In total, £139,000 of compensation has been paid out to 3,625 customers for distress and inconvenience, and no customers have so far been identified as suffering financial loss¹.

The Chair of the Treasury Committee, Dame Meg Hillier, said:

"Modern banking methods mean we can now perform a variety of tasks on our phones in a matter of seconds, and almost anywhere. What this incident brings into focus is the fact that there is a trade-off. By moving more interactions with our bank online, we place our faith in technology which can suffer unpredictable errors. It's critical that consumers understand this, and that's why my Committee continues to push banks to be transparent when things go wrong."

Treasury Select Committee, source¹

The Committee said that last March it found nine of the top banks had accumulated at least 33 days' worth of IT outages over the preceding two years¹.

Why it matters for households

The figures cover customers of three brands within one banking group, so the people affected are holders of current accounts and other products at Lloyds Bank, Halifax and Bank of Scotland, not only at one brand. The incident took place on 12 March and the group's initial assessment was published on 27 March¹.

For the 114,182 people who clicked on another person's transaction, the information that may have been displayed includes account details, national insurance numbers and payment references, which is identity and account information rather than money taken from an account¹. The group says no customers have so far been identified as suffering financial loss, and £139,000 has been paid to 3,625 customers for distress and inconvenience¹. The letter also notes that people who are not customers of the group may have had transaction information visible¹.

The Committee's wider point is about how much of everyday banking now depends on systems that can fail. Its earlier finding was that nine of the top banks had accumulated at least 33 days' worth of IT outages over the two years to the March before the letter was published¹. Where a payment or account problem follows a bank failure, the duties a bank owes a customer are set out in our guide to when a payment goes wrong, and the wider framework sits under consumer protection.

What happens next

The Chair has requested further updates from Lloyds Banking Group in one month and in six months' time¹. No further detail on the form those updates will take, or on any regulatory action, has been reported.

Sources1 cited