A Lloyds software defect exposed other people's transactions to 447,936 users

On 12 March 2026, a 'software defect' introduced during an overnight IT change at Lloyds Banking Group began showing customers of Lloyds, Halifax and Bank of Scotland other people's transactions — payments, charges, sometimes national insurance numbers — inside their own apps. The bank later told the Treasury Select Committee the glitch hit up to 447,936 customers, and that 114,182 clicked on transactions that were not theirs, potentially exposing 'account details, national insurance numbers and payment references'. Some data belonged to non-customers paid by Lloyds account holders.

Customers panicked. One, Asha, told the BBC she saw unknown transactions whose figures matched her balance totals — 'I assumed I was hacked or a fraud had went on... one transaction was by someone who bought a car. I thought they'd spent £8,000 of my money. It... left me feeling almost traumatised.' Lloyds said the issue was 'fixed promptly', that it had 'immediately investigated how the incident occurred', and that it was 'extremely sorry'. As of 23 March it had paid £139,000 in goodwill payments to 3,625 customers — an average of £38.34 each.

The bill is likely to grow. The Financial Conduct Authority said it was 'actively engaging' with the group; the Information Commissioner's Office opened enquiries; and committee chair Dame Meg Hillier turned the incident into a lesson about modern banking's trade-off — 'we place our faith in technology which can suffer unpredictable errors' — urging banks to be transparent when things go wrong. Industry analysts said a single update touching nearly half a million customers demanded 'deeper, structural change rather than surface-level fixes.'

£139,000 in goodwill payments to 3,625 customers so far; the FCA 'actively engaging', the ICO making enquiries, and a Treasury Select Committee probe.

An untested overnight change crossed the one boundary retail banking cannot cross: one customer's screen showed another customer's money.

The exposed data — account details, national insurance numbers, payment references — turned a glitch into a data-protection incident with the ICO at the door.

Compensation averaging £38.34 suggested the bank was still triaging, with regulators' outcomes and possible fines ahead.

The group's scale (26 million customers) made a single defect a systemic trust event across three bank brands at once.

Resilience is not recovery speed: when one overnight change can put strangers' salaries on your screen, the test that matters is account isolation, not uptime.

Lloyds said it would 'cooperate fully' with the FCA and ICO, was compensating distressed customers as a matter of practice, and had begun a root-cause investigation of the overnight change. The Treasury Select Committee published the bank's letter and kept pushing banks on transparency after incidents.