Lloyds Data Breach Exposes Customers

Nearly half a million customers of Lloyds Banking Group had personal information potentially exposed following a major IT malfunction linked to a software update across its mobile banking platforms, according to a letter disclosed by MPs.

The incident, which occurred during an overnight update on 12 March affecting the Lloyds, Halifax and Bank of Scotland mobile banking applications, was caused by a software defect introduced during the rollout. The glitch temporarily allowed customer data to be displayed incorrectly across user sessions.

According to the bank’s explanation to the Treasury Select Committee, customers would have needed to be actively using the app within “small fractions of a second” of another user for any cross-exposure of data to occur. Nevertheless, the scale of the incident was significant, with up to 447,936 individuals potentially affected.

Of those, approximately 114,182 customers reportedly clicked into transaction pages that exposed sensitive information, including account details, national insurance numbers, and payment references. The bank also confirmed that even some non-customers could have had transaction-related information inadvertently displayed.

Scale of the incident

Lloyds Banking Group reported the issue to the Financial Conduct Authority on the morning of the incident and informed the Information Commissioner’s Office within the required 72-hour window. The group stressed that its internal fraud and cyber monitoring systems have found no evidence of malicious exploitation or financial loss resulting from the glitch.

Jasjyot Singh, the bank’s chief executive of consumer relationships, stated that affected customers have been asked to delete any screenshots or recordings of exposed data, including material that may have been shared online. He added that the bank is continuing to monitor the situation closely for any signs of misuse.

So far, Lloyds has paid around £139,000 in compensation to 3,625 customers for distress and inconvenience, although it maintains that no direct financial losses have been recorded.

The incident comes amid growing scrutiny of the UK banking sector’s increasing reliance on digital platforms as traditional branches continue to close. The shift towards mobile and online banking has accelerated competition with digital-only providers, while raising concerns about system resilience and consumer protection.

The number of bank branches across the UK has fallen sharply in recent years, from roughly 10,565 to 6,870 over the past decade, according to official statistics. This trend has intensified reliance on mobile banking services, making system reliability increasingly critical.

Meg Hillier, chair of the Treasury Select Committee, highlighted the broader implications, noting that while digital banking offers speed and convenience, it also introduces new vulnerabilities. She emphasised that customers must be aware of the risks associated with relying heavily on technology that can occasionally fail in unpredictable ways.

Lloyds has pledged to provide further updates to MPs in April and September as its internal investigation continues and remedial actions are developed. The bank says it is committed to learning lessons from the incident and strengthening its systems to prevent similar failures in future.