CyberHappenings logo
☰
Home Browse Watchlists Experimental About

Track cybersecurity events as they unfold. Sourced timelines. Filter, sort, and browse. Fast, privacy‑respecting. No invasive ads, no tracking.

Transient data exposure flaw in Lloyds mobile banking update

First reported
Last updated
1 unique sources, 1 articles

Summary

Hide ▲

A transient software defect in a system update for Lloyds Banking Group’s mobile banking platform enabled temporary exposure of customer personal and transactional data to other users. The incident occurred during an overnight update on 12 March and affected customers of Lloyds, Halifax and Bank of Scotland, where brief overlapping app sessions allowed some users to view unrelated transactions, account details, payment references, and national insurance numbers. No evidence of subsequent financial fraud or data misuse has been reported, but 3,625 customers received compensation totalling £139,000.

Timeline

  1. 30.03.2026 17:00 1 articles · 14h ago

    Transient exposure of customer data in Lloyds mobile banking update

    A race condition introduced during an overnight system update on 12 March caused temporary misrouting of transaction data in Lloyds, Halifax and Bank of Scotland mobile banking apps. The defect allowed brief overlapping sessions to expose account identifiers, transaction details, payment references and national insurance numbers to other users. No evidence of financial fraud or misuse has been identified, and compensation totalling £139,000 was paid to 3,625 customers.

    Show sources
    Open in new tab

Information Snippets

  • The defect stemmed from a routine IT system update that introduced a race condition during session handling in the mobile banking applications.

    First reported: 30.03.2026 17:00
    1 source, 1 article
    Show sources

  • Customers had to access their apps within fractions of a second of another user’s session for the misrouted data to appear.

    First reported: 30.03.2026 17:00
    1 source, 1 article
    Show sources

  • Exposed data included transaction details, account identifiers, payment references, and national insurance numbers.

    First reported: 30.03.2026 17:00
    1 source, 1 article
    Show sources

  • Up to 447,936 customers were potentially exposed, with 114,182 customers reported as having clicked on transactions linked to other users.

    First reported: 30.03.2026 17:00
    1 source, 1 article
    Show sources

  • Lloyds Banking Group reported the incident to the UK Financial Conduct Authority on 12 March and notified the Information Commissioner’s Office within the required 72-hour window.

    First reported: 30.03.2026 17:00
    1 source, 1 article
    Show sources

  • Compensation of £139,000 was paid to 3,625 customers for distress and inconvenience; no evidence of financial loss or fraud has been identified.

    First reported: 30.03.2026 17:00
    1 source, 1 article
    Show sources