Lloyds Banking Group App Glitch Exposed Transaction Data of Nearly 450,000 Customers, Prompting UK Treasury Committee Investigation
A software defect during an overnight update let Lloyds, Halifax, and Bank of Scotland app users see other customers' transactions, account numbers, and National Insurance numbers for nearly five hours.
Overview
A software defect introduced during an overnight system update on March 12 allowed customers of Lloyds, Halifax, and Bank of Scotland mobile apps to view transaction data belonging to other users for nearly five hours. The UK Parliament’s Treasury Committee has launched a formal investigation after determining that up to 447,936 customers were affected, according to The Register.
What Happened
The incident occurred between 03:28 and 08:08 GMT on March 12, triggered by a software defect pushed during an overnight update between March 11 and 12. The flawed API broke account isolation when two users accessed the transaction function simultaneously, allowing one to see fragments of the other’s account activity, as reported by The Register.
Of the 21.5 million mobile banking users across the three brands, 1.67 million logged in during the incident window. Of those, 447,936 may have been exposed to other people’s transaction lists, and 114,182 clicked into individual transactions that could have revealed more detailed information, according to The Register.
The data potentially visible included transaction amounts, dates, payee information, sort codes, account numbers, and personal identifiers embedded in transaction references such as National Insurance numbers and vehicle registration details. Transaction information belonging to non-Lloyds customers who were recipients of payments from affected accounts may also have been exposed, as reported by The Register.
Regulatory Response
Treasury Committee Chair Dame Meg Hillier stated that it is “critical that consumers understand this” and that the committee would “continue to push banks to be transparent when things go wrong,” according to The Register. The committee wrote to Lloyds CEO Charlie Nunn on March 17 demanding a detailed accounting of the number of affected customers, the nature of the information that became visible, expected compensation payouts, and the steps taken to prevent a recurrence.
Lloyds is required to provide an initial assessment within one month of whether any customers have fallen victim to financial crime as a direct result of the exposed data. A full incident report and prevention plan is due within six months, according to The Register.
The bank notified regulators on the morning of the incident, completing its notification to the Information Commissioner’s Office within the required 72-hour window. Lloyds has paid approximately 139,000 pounds in goodwill payments to 3,625 customers for distress and inconvenience. No customers have so far been identified as suffering direct financial loss, as reported by The Register.
What We Don’t Know
It remains unclear whether any of the exposed data has been exploited for fraud or identity theft. The one-month assessment demanded by the Treasury Committee is expected to provide an initial answer. The full extent of what information was accessed by each of the 114,182 users who clicked into others’ transactions has not been disclosed.
Whether the ICO will open a formal investigation or consider enforcement action under UK GDPR has not been announced. The identity of the specific software update that introduced the concurrency bug has not been publicly detailed.
Analysis
The incident underscores the fragility of digital banking infrastructure at a time when UK lenders are accelerating branch closures and shifting customers to mobile-first services. The root cause, a concurrency bug in an API update that broke account isolation, points to a testing gap in the deployment pipeline rather than a sophisticated external attack. That the defect survived overnight testing and reached production for nearly five hours before being caught raises questions about the bank’s quality assurance and monitoring processes for changes that touch customer-facing data isolation.
With the Treasury Committee setting a six-month deadline for a full incident report, Lloyds now faces sustained parliamentary scrutiny over how a routine software update exposed the financial lives of nearly half a million customers.