Lloyds pays compensation after data breach exposes nearly 450,000 customers

Thousands already compensated for distress after an IT glitch allowed customers to see others’ financial data, with up to 447,000 affected.

Lloyds Banking Group has confirmed that nearly half a million customers had their personal data exposed after an IT glitch earlier this month. Up to 447,936 customers across Lloyds, Halifax and Bank of Scotland were affected when a software defect caused some users to see other people’s transactions through the bank’s app.

The incident, which occurred on 12 March, was caused by a fault introduced during an overnight IT update. Lloyds confirmed that 114,182 customers clicked on transactions that were not their own, meaning they may have been shown more detailed information including account details, national insurance numbers and payment references. Personal data belonging to non-Lloyds customers was also visible.

The bank has so far paid out £139,000 in compensation to 3,625 customers for distress and inconvenience. No customers have yet been identified as suffering financial losses as a result of the incident.

Nikki Stopford, co-founder of Consumer Voice, said: 

“Big companies may be hit by data breaches, but it’s ordinary people who live with the consequences. When personal data isn’t properly protected, firms must be held accountable, and that includes paying compensation for the distress caused.”

Jasjyot Singh, Lloyds’ consumer relations director, apologised for the incident in a letter to Parliament’s Treasury Select Committee disclosing the full scope of the issue.

Chair of the Treasury Committee Dame Meg Hillier said the incident highlighted a broader tension in modern banking: “What this incident brings into focus is the fact that there is a trade-off. By moving more interactions with our bank online, we place our faith in technology which can suffer unpredictable errors.”

Sign up to Consumer Voice to stay updated on data breaches and what they mean for you. 

What happened in the Lloyds data breach

The glitch occurred on 12 March when an overnight software update introduced a defect into Lloyds’ app. For a period, some customers logging in were able to see transactions belonging to other account holders. In cases where customers clicked through on those transactions, more sensitive data – including account numbers, national insurance numbers and payment references – may have been visible.

Lloyds said the issue was quickly identified and resolved, and that affected customers have been contacted. The bank confirmed that the data of individuals who are not Lloyds group customers was also exposed during the incident.

What this means if your Lloyds, Halifax or Bank of Scotland data was exposed

Lloyds has said it has already contacted customers whose transactions may have been visible. If you are a Lloyds, Halifax or Bank of Scotland customer and have not heard from the bank but are concerned your data may have been exposed, you should contact them directly.

The bank has already paid compensation to thousands of customers for distress and inconvenience, which shows that affected individuals do not necessarily need to have suffered financial loss to receive a payout.

In the meantime, it is worth monitoring your bank accounts and credit report for any unusual activity, being alert to suspicious emails or calls referencing your account and avoiding sharing personal information unless you have independently verified who you are speaking to.

Data breaches affecting UK consumers – you may have more claims than you realise

The Lloyds incident is the latest in a series of significant data breaches affecting UK consumers in recent months. If you have been caught up in any of the following, you may be entitled to compensation.

Legal Aid Agency

In May 2025, the Legal Aid Agency confirmed it had been the victim of a major cyber attack affecting its online digital services. The Government has since confirmed that attackers accessed and downloaded a significant volume of highly sensitive personal data relating to people who applied for legal aid over an 18-year period, dating back to January 2007.

The compromised data may include names, addresses, dates of birth, national insurance numbers, financial information, criminal history and details relating to legal proceedings, some of the most sensitive personal data imaginable.

If you applied for legal aid between January 2007 and 16 May 2025, you may be eligible to join the group claim. Consumer Voice is working with specialist law firm Bingham Long to help affected people claim compensation.

M&S

M&S confirmed a cyber attack in April 2025 that disrupted online orders and exposed customer data including contact details and order histories. If you are an M&S customer and received a notification about the breach, you may have grounds to claim compensation for distress and loss of control of your personal data.

Southern Water

Southern Water confirmed in early 2024 that it had suffered a data breach affecting current and former customers and employees, with sensitive personal data accessed by attackers. If you are a Southern Water customer, you can find out more about your rights and options here.

Could you be owed data breach compensation?

Data breach compensation does not require you to have suffered financial loss. Distress, anxiety and loss of control over your personal information can all form the basis of a legitimate claim.

Find out what you could be owed in our data breach compensation guide.