FCA Fines Tesco Bank For Data Breach

On 1 October 2018, the FCA fined Tesco Personal Finance plc (Tesco Bank) £16.4 million for failures relating to a cyber attack. Over a 48-hour period in November 2016, cyber criminals stole £2.26 million from more than 8,000 of Tesco Bank's 131,000 personal current account customers. The incident received significant press attention at the time. Nearly two years later the FCA has delivered its verdict that, in summary, Tesco Bank should have done more both before the attack and in response to it. These attacks are a growing threat and we are seeing a big increase in requests for advice and assistance in this area. This is also driven by GDPR (see below).

The fine was heavily discounted from £33,562,400 which the FCA states that it would have imposed were it not for mitigation credit (to reflect co-operation and remedial action and a discount for early settlement). Nonetheless it sends a strong message to the market about the FCA's stance on cyber security breaches,