Lloyds bank accounts targeted in huge cybercrime attack

Lloyds Banking Group suffered 48-hour online attack this month as cybercriminals attempted to block access to 20m UK accounts.

The denial of service attack ran for two days from Wednesday 11 January to Friday 13 January, as Lloyds, Halifax and Bank of Scotland were bombarded with millions of fake requests, designed to grind the group’s systems to a halt. Usually in a denial of service (DOS) attack the criminals demand a large ransom, to be paid in bitcoins, to end the onslaught.

However, no accounts were hacked or compromised during the attack, and Lloyds did not pay a ransom.

In a cat-and-mouse game across the planet, IT security experts at Lloyds “geo-blocked” the source of the attack. This effectively drops a portcullis over the server launching the attacks, but also stops legitimate customer requests from that area too. The cybercriminals then move to another server, and the geo-blocking game begins again.

It explains the intermittent nature of the service issues at Lloyds during the period of the attack, with some customers complaining that they could not log on, but most experiencing normal service.

Lloyds declined to comment on the specific nature of the attack. In a statement, it said: “We experienced intermittent service issues with internet banking between Wednesday morning and Friday afternoon the week before last and are sorry for any inconvenience caused.

“We had a normal service in place for the vast majority of this period and only a small number of customers experienced problems. In most cases if customers attempted another log-in they were able to access their accounts.

“We will not speculate on the cause of these intermittent issues.”

Andrew Tyrie, chair of the House of Commons Treasury select committee, called for the financial services industry to create a single point of responsibility to tackle cyber risks. In a statement issued on Monday, he said: “As millions of customers are exposed to the risks of cybercrime, a higher level of scrutiny and accountability for existing arrangements is needed.”

The incident comes just months after a far more serious cyber-heist against Tesco Bank, when criminals launched an “unprecedented” online attack that resulted in the loss of £2.5m from 9,000 accounts.

Several other major British banks have been hit by service outages over the past two years when their systems were flooded with fake requests.

In January last year, HSBC’s internet banking facility was made unavailable following a DOS attack, but no transactions were affected.

In 2015, Royal Bank of Scotland revealed it suffered a cyber-attack on its online services that left customers struggling to log on for nearly an hour – just as monthly pay cheques were arriving in accounts.

The threat to Britain’s financial infrastructure from persistent cyber-attacks was partly behind the pledge by the chancellor, Philip Hammond, in November to spend an extra £1.9bn protecting UK online defences.

Outdated computer systems are allowing malicious hackers to target everyone from companies at board level to individuals in their living rooms, according to the chancellor.

The money will help boost the National Cyber Security Centre, the new division of the surveillance agency GCHQ created last month.

Andrew Tyrie, MP, chair of the Treasury select committee, said that responsibility for reducing cyber threats is shared too widely among a number of bodies, including the Prudential Regulatory Authority, the Financial Conduct Authority and GCHQ, and needs to be simplified.

“The attack on Lloyds was deeply troubling. Thousands of customers were affected by this, the latest in a long list of failures and breaches of banking IT systems.,” he said.

“As I have already pointed out, it is time to consider whether a single point of responsible for cyber risk in the financial services sector is now required.”