Lloyd's bank accounts targeted by cyber attack

Lloyd’s Banking Group’s three-day online banking glitch affecting 20m UK accounts was caused by a cyber attack.

Cybercriminals ran a denial of service (DOS) attack from Wednesday 11 January 2017 to Friday 13 January 2017 in an attempt to block access to customers’ bank accounts.

Lloyds, Halifax and Bank of Scotland were barraged with millions of fake requests designed to bring the group’s system to a standstill.

DOS hacks usually involve the criminals requesting a ransom to end the attack but Lloyds have yet to indicate whether any demands have been made.

No accounts were hacked or compromised during the attack, unlike the cyber-heist against Tesco Bank wherein £2.5m was stolen from 9,000 accounts.

IT security experts at Lloyds “geo-blocked” the source of the attack after which the cybercriminals moved to another server.

“We experienced intermittent service issues with internet banking between Wednesday morning and Friday afternoon the week before last and are sorry for any inconvenience caused," said Lloyds in a statement.

“We had a normal service in place for the vast majority of this period and only a small number of customers experienced problems. In most cases if customers attempted another log-in they were able to access their accounts.

“We will not speculate on the cause of these intermittent issues."

Chair of the House of Commons Treasury select committee Andrew Tyrie called for the financial services industry to create a single point of responsibility to take on cyber risks.

“As millions of customers are exposed to the risks of cybercrime, a higher level of scrutiny and accountability for existing arrangements is needed,” said Tyrie.

Philip Hammond pledged in November to spend an extra £1.9bn protecting UK online defences. The investment will help boost the new division created at surveillance agency GCHQ last month, called the National Cyber Security Centre (NCSC), which is currently working with Lloyds on the attack.

Many other British banks like HSBC and RBS have reported service outages over the past two years after their systems were flooded by fake requests.