2026 Lloyds Banking Group — faulty mobile update; ~450K customers’ transaction data exposed to other users

On March 12, 2026, Lloyds Banking Group (Lloyds Bank, Halifax, Bank of Scotland) experienced a serious but non-ransomware IT incident: an overnight software/API change introduced a defect that broke isolation between customer accounts in mobile banking, so some users briefly saw other customers’ transactions and related on-screen details (e.g., names, postcodes, salaries, benefit payments, and in some reports sort codes, account fragments, or national insurance numbers) when viewing transaction lists. Parliamentary and press summaries later cited on the order of ~447,936–450,000 customers affected across the incident window (e.g., ~03:28–08:08 GMT in some accounts), with a subset clicking through to detailed transaction views—not “millions” of users at the scale suggested in some informal social reframes. Lloyds attributed the issue to its own change (not an external cyberattack), resolved it the same morning, and faced FCA/ICO scrutiny. Treat as a confidentiality/privacy incident (cross-customer visibility) rather than a classic centralized database exfiltration.