FCA set to impose record fine on Tesco Bank of “unprecedented” cyber attack

The retail giant’s banking arm, which employs more than 2000 staff at its headquarters in the Scottish capital, fell victim to a sustained cyber attack in November 2016, which saw criminals access around 9000 people’s savings and led Tesco to pay back around £2.5 million.

Tesco’s systems were also down for two days as a result, leaving customers unable to make any transactions in that time.

According to Sky News, City watchdog, the Financial Conduct Authority (FCA), is now considering imposing a record financial penalty Tesco for the heist which was described at the time as “unprecedented”.

In giving evidence to a UK Tresury Select Committee hearing, FCA chief executive Andrew Bailey restated the criticism of the challenger bank, calling the incident an “unprecedented and serious” cyber attack.

Bailey also censured Tesco Bank for its communication during the outages following the attack which he said was “not transparent enough”. At the time, affected customers complained of being left on hold for hours at a time.

The FCA’s investigation sought to establish whether customers were left exposed by Tesco Bank after it issues sequential debit card numbers, a practice avoided by other banks as it is makes it easier for hackers to guess expiry dates and security codes.

This will mark the first time the FCA has issued such a significant fine on a financial institution for a cyberattack.

Last year the regulator’s director of supervision voiced concerns that banks were “materially under-reporting” cyberattacks.

Since Tesco’s attack in 2016 cybercriminals have ramped up their attacks on both financial institutions and retailers, leading companies to invest billions in their defences and regulators to grant them far less leeway.